Privacy Policy

Privacy Policy

Last Updated: August 12, 2024

Privacy Policy Table of Contents:

Our Commitment to Privacy
Information We Collect About You and How We Collect It
Children
How We Use Your Information
Disclosure of Your Information
Choices About How We Use and Disclose Your Information
California Do Not Track Disclosures
Privacy Rights and Additional Disclosures for California and Other State Residents
Notice of Financial Incentive
Biometric Information Privacy Policy
Accessing and Correcting Your Information
Transfer of Information
Data Security
Changes to Our Privacy Policy
How to Contact Us

OUR COMMITMENT TO PRIVACY

White Castle Management Co. (“White Castle” or “we”) respects your privacy and is committed to protecting it through our compliance with this Privacy Policy (“Privacy Policy”). We have developed this Privacy Policy to describe the types of information we may collect from visitors to the websites whitecastle.com and online.whitecastle.com and our mobile application, including any content, functionality and services offered on or through such websites and our mobile application (the “App”), in each case whether as a guest or a registered user (the websites, App and any content, functionality and services are referred to herein collectively as, the “Sites”) and our practices for collecting, using, maintaining, protecting, and disclosing that information. This Privacy Policy is effective from the effective date noted above. Please read this Privacy Policy carefully to understand our policies and practices regarding your information. If you do not agree with our policies and practices, your choice is not to use our Sites. By accessing or using our Sites, you acknowledge this Privacy Policy. This Privacy Policy may change from time to time. Your continued use of the Sites after we make changes is deemed to be acceptance of those changes, so please check the Privacy Policy periodically for updates.

This Privacy Policy applies to information we collect:

On the Sites.
In email, text and other electronic messages between visitors to the Sites and the Sites.

This Privacy Policy does not apply to information collected by:

Us offline or through other means, including on any other website operated by a third party or licensee; or
Any third party, including through any application or content (including advertising) that may link to or be accessible from or on the Sites.

INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT IT

Information Collected Automatically

As you navigate through and interact with our Sites, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

Details of your visits to our Sites, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website.
IP addresses (a number automatically assigned to your computer whenever you are surfing the internet). Web servers automatically identify your computer by its IP address. When visitors request pages from our Sites, our servers typically log their IP addresses. We collect IP addresses for purposes of system administration, to report aggregate information to others and to track the use of our Sites. IP addresses may also be disclosed and used as provided in this Privacy Policy.
The type of browser you are using (e.g., Internet Explorer, Firefox, Safari, etc.).
The third-party website from which your visit originated.
The operating system you are using.
The domain name of your internet service provider.
The search terms you use on our Sites, the specific web pages you visit and the duration of your visits.

We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services.

We use information in a variety of ways, including to help analyze traffic of the Sites, understand customer needs and trends, carry out targeted promotional activities, store information about your use preferences (allowing us to customize our Sites according to your interests), to speed up your searches on our Sites, to recognize you when you return to our Sites and to improve our services, to enable augmented reality experiences. As permitted by law, we may use your information by itself or aggregate it with information we have obtained from others, and we may disclose anonymized information with our affiliated companies and third parties to achieve these objectives and others.

The technologies we use for automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer.
Web Beacons. Pages of our Sites and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit White Castle, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Third-party Use of Cookies

The Sites use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies,” which are text files placed on your computer to help the website analyze how visitors use the Sites. The information generated by the cookie about your use of the Sites (including your IP address) will be transmitted to and stored by Google. Google may use this information for the purpose of evaluating your use of the Sites, compiling reports on activity and providing other services relating to activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. Additional information on how Google Analytics collects and processes data may be made available by Google at the following website: www.google.com/policies/privacy/partners/.

The Sites also use Google Marketing Platform advertising products, including: Display & Video 360, Search Ads 360, and Campaign Manager and Google Ad Manager. These products use cookies to improve advertising. Some common applications are to target advertising based on what is relevant to a user, to improve reporting on campaign performance, and to avoid showing ads the user has already seen. Google indicates that users may opt out of ads personalization by using Google’s Ads Settings available at the following website: https://www.google.com/settings/ads

By using this website, you acknowledge the processing of data about you by Google in the manner and for the purposes set out above. If you do not want your data being used by Google Analytics, please note that you may opt-out of having or making your activity on our Sites available to Google Analytics by installing the Google Analytics opt-out browser add-on provided by Google. Additional information may be made available by Google at the following website: https://support.google.com/analytics/answer/181881?hl=en&ref_topic=2919631

Information You May Choose to Provide to Us

The information we collect on or through the Sites may include:

Information that you may provide by filling in forms on our Sites at the time of registering for promotions or certain services offered through our Sites. This information might include information such as name, postal address, email address, telephone number or any other identifier by which you may be contacted online or offline.
Information from your device camera and otherwise during augmented reality experiences.
Records and copies of your correspondence (including email addresses), if you contact us.
Your responses to optional surveys that we might ask you to complete for research purposes.
Details of transactions you carry out through our Sites and regarding the fulfillment of orders. You may be required to provide financial information before placing an order through our Sites.

Mobile Alerts/Promotional Text Messages

White Castle will not contact you by text message without your prior express consent. White Castle will not disclose your mobile phone number to unaffiliated parties other than with third-party messaging service providers with whom White Castle has contracted. By submitting your mobile phone number and expressing your consent to a text messaging marketing campaign, alert service, or the like, you agree to the terms of that promotion made available to you when you provide your prior express consent, which likely includes that White Castle may send to you updates or offers, information about promotions, new menu items, merchandise, events, and other relevant information by text message. You may opt out of receiving text messages or notifications by following the opt-out instructions included with all such messages or by calling 1-800-843-2728 (1-800-THE-CRAV) toll free.

ONLY INDIVIDUALS SIXTEEN (16) YEARS OF AGE OR OLDER MAY REQUEST EMAIL UPDATES OR MOBILE ALERTS/PROMOTIONAL TEXT MESSAGES.

Sweepstakes/Contests

We may, at various times, use the Sites to collect information for contests, promotions or sweepstakes. The information you enter for contests, promotions or sweepstakes is voluntarily submitted by you. You may also receive informative email messages as a result of your contest entry unless you have chosen to opt-out of receiving such messages, either at the time of sign up or in accordance with the opt-out instructions included with the informative message(s) delivered to your email inbox.

Contact Us Information

If you choose to contact us, we may collect information potentially including your name, email address, mailing address, phone number and your suggestion, question, comment or customer service request. We use the information to process your suggestion or customer service request. We may also use this information to improve our products and services. For more information, please see the Terms and Conditions of Use.

Third-Party Service Providers, Material or Links

We may use third-party service providers for things such as the sale of gift cards or White Castle-branded apparel and gifts, or the provision of marketing services on behalf of White Castle. If you would like to purchase White Castle products through an online store, you may do so by navigating through the appropriate link on our Sites. Apparel, gift cards and other services may be provided by a third party, and you may have to leave our Sites in order to visit the store or to make a purchase. Please note the domain address after clicking a link on our Sites, and please review any terms and conditions and privacy policy or notice postings that appear through the links on the individual web pages. We may also, from time to time, contract with advertisers or other third parties who place information, advertisements or other promotional material or links on our Sites. If you click on an advertisement or other link provided by a third party and leave our Sites, whether through a link or through visiting another website framed within our Sites, you are subject to the privacy policies of these advertisers or other third parties. We do not have responsibility for or access to the information collected through an online store or other online function provided by a third party and are therefore not responsible for the security of that information and not liable for any breach of that security.

Employment Information

If you would like to become a White Castle employee, you may choose to search for job openings or submit an employment application online through the “Join Our Team,” “Job Search,” “Careers” or other similarly titled link. All information entered by you through the Employment function of the Sites is collected by a third-party service provider responsible for collecting the information and matching the information with White Castle job openings. The information collected through the application will be used by the service provider to match your credentials with White Castle job openings, of which you will be informed via your email address. White Castle is not responsible for the security of the information while retained exclusively by the third party service provider and is not liable for any breach of that security. You may apply for employment with White Castle by performing a job search, clicking on the job title, and then clicking the “Apply” link.

Public Forums/User Contributions

We may offer chat rooms, blogs, message boards, bulletin boards or similar public forums where you and other users of our Sites can communicate or post photographic or other content (collectively, “User Contributions”). Your User Contributions are posted at your own risk. We may use information about you to identify you with a posting in a public forum. Your User Contributions are posted on and transmitted to others at your own risk. Please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Sites with whom you may choose to disclose your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will only be viewed by authorized persons. Any information you disclose in a public forum may be seen or collected by anyone, including third parties that do not adhere to our Privacy Policy. We are not responsible for events arising from the distribution of any information you choose to publicly post or disclose through our Sites.

Information of Others

If you choose to submit the information of someone other than yourself without White Castle’s knowledge, the information will be handled in accordance with this Privacy Policy. You, however, are solely responsible and liable for any claims relating to your submission and use of that information.

CHILDREN

Our Sites are not intended for children. We do not knowingly collect personal information from children under the age of 16. Do not use our Sites or provide any information unless you are at least 16 years of age.

Although our Sites are not directed to children, the Children’s Online Privacy Protection Act (“COPPA”) provides that if we have actual knowledge that we are collecting personal information from children under the age of 13, we must meet specified requirements. If you are a parent or guardian of a child under the age of 13, and believe he or she has disclosed personal information to us, please contact us as provided in this Privacy Policy. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. A parent or guardian of a child under the age of 13 may review and request deletion of such child’s personal information as well as prohibit the use thereof. If you believe we might have any information from or about a child under 13, please send us an email at ChildPrivacy@whitecastle.com.

HOW WE USE YOUR INFORMATION

We use information that we collect about you or that you provide to us, including any personal information:

To present our Sites and the Sites’ contents to you.
To provide you with information, products or services that you request from us.
To fulfill any other purpose for which you provide it.
To provide you with notices about your account or subscriptions.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
To notify you about changes to our Sites or any products or services we offer or provide though the Sites.
To allow you to participate in interactive features on our Sites.
To enable augmented reality experiences on or through our Sites.
In any other way we may describe when you provide the information.
For any other purpose with your consent.

DISCLOSURE OF YOUR INFORMATION

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or that you provide as described in this Privacy Policy:

To our subsidiaries and affiliates.
To contractors, service providers and other third parties for the support of our business and the Sites.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of White Castle’s assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal information held by White Castle about our Sites’ users is among the assets transferred.
To third parties to market their products or services to you if you have not opted out of these disclosures.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by us when you provide the information.
With your consent.

We may also disclose your personal information:

To comply with any court order, law or legal process, including responding to any government or regulatory request.
To enforce or apply our Terms and Conditions and other agreements, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect the rights, property or safety of White Castle, our customers or others.

CHOICES ABOUT HOW WE USE AND DISCLOSE YOUR INFORMATION

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

Promotional Offers from White Castle. If you do not wish to have your email address used by White Castle to promote our own or third parties’ products or services, you can opt-out at any time by submitting a Request to Delete

. If we have sent you a promotional email, you may unsubscribe through the link or other “unsubscribe” instructions provided in the footer of the applicable email.

Nevada consumers who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A, as amended, may submit by submitting a Request to Delete.

CALIFORNIA DO NOT TRACK DISCLOSURES

California Business & Professions Code Section 22575(b)(5) (as amended effective January 1, 2014) provides that California residents are entitled to know how the Sites respond to “Do Not Track” browser settings. We do not currently take any actions with respect to received Do Not Track signals. In general, our system will issue cookies when you direct your browser to our Sites, as described in this Privacy Policy.

PRIVACY RIGHTS AND ADDITIONAL DISCLOSURES FOR CALIFORNIA AND OTHER STATE RESIDENTS

If you are a California resident, California law may provide you with additional rights regarding our use of your personal information. California’s “Shine the Light” law (California Civil Code § 1798.83) permits users of our Sites that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. White Castle does not disclose personal information to third parties for their direct marketing purposes. Nonetheless, to make such a request, please call us at 1-800-843-2728 (1-800-THE-CRAV), or click on the “Contact Us” / “General Feedback” link located on our Sites.

The information contained in this section of the Privacy Policy and the Notice of Financial Incentive section below, applies solely to Site users who meet the definition of the term “consumer” as defined under the California Consumer Privacy Act, as amended, and the then current regulations adopted by the California Attorney General and the California Privacy Protection Agency pursuant thereto (collectively, the “CCPA”) and to other individuals entitled to analogous rights and disclosures under applicable state law, including without limitation the Colorado Privacy Act and the rules adopted by the Colorado Attorney General, and Nevada Revised Statutes Chapter 603A, as amended, and the Virginia Consumer Data Protection Act, and the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act, and the Illinois Biometric Information Privacy Act, and all other applicable U.S. state and federal privacy laws (collectively, with the CCPA, as applicable “Privacy Laws”). Terms, and correlative terms, defined in the Privacy Laws contained in this section are intended to have the same meaning and effect as set forth in the Privacy Laws.

White Castle obtains the categories of personal information listed in the table below from the following categories of sources: (i) the consumer directly, (ii) indirectly from the consumer, for example, by observing certain interactions with our Sites, (iii) government entities from which public records are obtained, and (iii) consumer data resellers.

Categories of Personal Information and Processing Purposes

White Castle collects personal information on and through its Sites. In particular, within the last twelve (12) months, on or through the Sites, White Castle has collected the categories of personal information indicated in the table below from consumer Site users, and we collect and process such personal information including sensitive personal information for the business, commercial, and other purposes set forth in such table, and for purposes for which we obtain consent, and purposes that are not materially different from those disclosed or consent is obtained, and as otherwise permitted by Privacy Laws.

Categories of Consumer Personal Information Sold or Shared

White Castle may share or sell personal information including sensitive personal information to third parties, subject to your right to opt-out of such selling and sharing. White Castle does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age. In the preceding twelve (12) months, White Castle has sold the categories of personal information and sensitive personal information to the categories of third parties as indicated in the table below.

Retention Period

White Castle intends to retain each category of personal information for the period necessary for the processing purpose, or such shorter period as set forth in the table below.

Personal Information Collection, Processing Purposes, and Categories of Sources

White Castle may use personal information for the business and commercial purposes set forth in the table below, and as permitted by Privacy Laws for purposes that are not materially different from those disclosed in table below, and as otherwise permitted by Privacy Laws.

White Castle may obtain the categories of personal information listed in the table below from the following categories of sources: (a) the consumer directly, (b) government entities from which public records are obtained, and (c) vendors or other third parties, and as otherwise indicated to the consumer at the time of collection.

Sensitive Personal Information

Sensitive personal information, including precise geolocation information is collected and disclosed for delivery and order fulfillment purposes, and for such other purposes as set forth in the table below. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

Categories of Personal Information	Personal Information Collected	Processing Purposes	Retention Period	Personal Information Sold or Shared	Categories of Third Parties Personal Information Sold or Shared
Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.	To enable the use of our Sites, to communicate with you, for targeted advertising, and to enable the use of our Sites, to communicate with you, for targeted advertising, and to personalize offers, and perform other marketing services, including planning future advertising services; to suggest regional offers; to suggest the nearest White Castle location; to enable offers when a user is physically near locations, performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. Site auditing; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, including use to assure security when users utilize location-specific offers, and for other security and risk purposes; by way of example, we may record both video and audio in our physical White Castle locations for security and risk purposes. Providing services to the consumer, including fulfilling orders; delivering orders verifying consumer information, including credit address and service contact verification.	24 months after last interaction with WC. We do not delete User Accounts for ordering except on request.	All attributes shared.	Advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.
Protected classification characteristics under California or federal law	Sex; indication that age is over 13; indication that age is over 18; indication that age is over or under 40; ethnicity; indication of languages spoken.	Application for employment requires age. Declaration of age over 18 to join programs. A selection of Male/Female/Other/Do not wish to say, Day of birth and Month- for birthday offers and presents. EEO on employment application requires Ethnicity. To personalize offers, and perform other marketing services, including planning future advertising services; performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. Site auditing; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, including use to assure security when users utilize location-specific offers, and for other security and risk purposes; by way of example, we may record both video and audio in our physical White Castle locations for security and risk purposes. Providing services to the consumer, including fulfilling orders, verifying consumer information, including credit address and service contact verification. With respect to biometric information collected through the JULIA AI, for the purposes set forth below this table. With respect to employee biometric information, for the purposes set forth in the Employee Biometric Data section below Biometric Information.	24 months- after last interaction with WC. We do not delete User Accounts for ordering except on request.	All attributes shared.	Advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.
Commercial information	Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	To personalize offers, and perform other marketing services, including planning future advertising services; performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. Site auditing; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, including use to assure security when users utilize location-specific offers, and for other security and risk purposes; by way of example, we may record both video and audio in our physical White Castle locations for security and risk purposes. Providing services to the consumer, including fulfilling orders, verifying consumer information, including credit address and service contact verification.	24 Months Inactive customers person data is scrubbed after 24 months of activity.	All attributes shared.	Advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.
Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, voiceprints.	With respect to biometric information collected through the JULIA AI, for the purposes set forth below this table. With respect to employee biometric information, for the purposes set forth in the Employee Biometric Data section below Biometric Information.	With respect to biometric information collected through the JULIA AI experience, see JULIA AI Biometric Information Retention Schedule below. With respect to employee biometric information, the year end after final payment to employee.	None	None
Internet or other similar network activity	Browsing history, search history, information on a consumer’s interaction with a website or application, or certain White Castle Drive-thru experiences, or advertisement.	To personalize offers, and perform other marketing services, including planning future advertising services. Performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. Determining what parts of our Sites are functioning well. Site auditing; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, including use to assure security when users utilize location-specific offers, and for other security and risk purposes; by way of example, we may record both video and audio in our physical White Castle locations for security and risk purposes.	24 months	All attributes shared	Advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.
Geolocation data, including precise geolocation information.	Physical location or movements.	To personalize offers, and perform other marketing services, including planning future advertising services. to suggest regional offers; to suggest the nearest White Castle location. To enable offers when a user is physically near locations, performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. To enable augmented reality experiences. Determining what parts of our Sites are functioning well. Site auditing; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, including use to assure security when users utilize location-specific offers, and for other security and risk purposes; by way of example, we may record both video and audio in our physical White Castle locations for security and risk purposes. providing services to the consumer, including fulfilling orders; verifying consumer information, including credit address and service contact verification.	24 months	All attributes shared.	Advertising networks, internet service providers, data, operating systems and platforms, social networks, and data brokers.
Sensory data	Audio, electronic, visual.	To enable augmented reality experiences. Performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. Site auditing; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, including use to assure security when users utilize location-specific offers, and for other security and risk purposes; by way of example, we may record both video and audio in our physical White Castle locations for security and risk purposes.	24 months	None	Internet service providers, data , operating systems, Government entities and platforms, social networks, and data brokers.
Professional or employment-related information	Current or past job history or performance evaluations	Collected for consumers, in their capacity as an applicant or employee.	During employment application processing is differently, based on employment. Application with no employment are kept for future compatible consideration and use. All Employee data follows requirements for retention deemed by GAAP, post-employment benefit plans and government regulations for DOL and EEO auditing.	All attributes shared.	Government entities and supportive employee plan providers.
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99))	Not Collected	N/A	N/A	N/A	N/A
Inferences drawn from other personal information	Profile reflecting a person’s preferences, characteristics, behavior, attitudes, and age.	To personalize offers, and perform other marketing services, including planning future advertising services. Performing marketing services, including, among others, analyzing trends in marketing and loyalty, suggestive ordering, understanding how to market to the consumer and what ads are driving new business. To suggest regional offers; to suggest the nearest White Castle location. To enable offers when a user is physically near locations,	24 Months Inactive customers person data is scrubbed after 24 months of activity.	All attributes shared.	Advertising networks, internet service providers, data , operating systems and platforms, social networks, and data brokers

Certain White Castle Drive-thru experiences are equipped with the JULIA voice assistant. If you consent to participate in the JULIA AI experience, an audio recording of your voice will be captured, collected, stored, shared, and used by White Castle, and its subcontractors including without limitation SoundHound. The voice audio recording will be processed to enable, effect, facilitate or fulfill White Castle orders, and to improve, upgrade, or enhance the JULIA AI experience by training machine learning models to better understand and respond to spoken words.

To fulfill these purposes, the voice audio recording may be retained and destroyed in accordance with the “JULIA AI Biometric Information Retention Schedule” below.

Privacy Laws provide certain consumers with specific rights regarding their personal information. We include below a plain and straightforward description of these rights, along with an explanation of how consumers may exercise them, if applicable.

Right to Know

Consumers have the right to request that we disclose what personal information we have collected about the consumer, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we collected about the consumer.

Right to Delete

Consumers have the right to request the deletion of their personal information that we collect or maintain about that consumer, subject to certain exceptions.

Right to Correct

Consumers have the right to request that we correct inaccurate personal information that we maintain about the consumer.

Right to Opt-Out of Sale/Sharing

Consumers have the right to opt-out of the sale or sharing of their personal information.

Right to Limit

Consumers have the right to request White Castle limit its use or disclosure of their sensitive personal information.

Right not to Receive Discriminatory Treatment

Consumers have the right not to receive discriminatory treatment by White Castle for the exercise of the privacy rights conferred by Privacy Laws, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their rights under Privacy Laws.

How to Exercise Consumer Rights to Know, Delete, or Correct

Consumers may exercise the applicable rights directly or through an authorized agent. To exercise applicable rights through an authorized agent, the consumer must designate the agent to make the request on their behalf by providing the agent with written permission to do so. In the event a right is exercised by an agent on behalf of a consumer, the agent must provide us with proof of their authorization by submitting a copy of the consumer’s written authorization at the time the request is made by the agent.

To exercise the applicable right, the consumer or its authorized agent may submit a verifiable consumer request to us by either:

Calling us at 1-800-843-2728 (1-800-THE-CRAV).
Clicking on the “Consumer Privacy Request” link located in the “Legal Stuff” tab on our Sites under “MORE” on the Sites.

The request must include sufficient information that allows us to reasonably verify that the person making the request is the consumer (or the authorized agent of the consumer) about whom we collected the personal information.

In addition, of course, the request must include sufficient detail that allows us to properly understand, evaluate, and respond to it. By way of example, a request to delete information, or to know categories of personal information, or to know specific pieces of personal information, or to correct personal information must specifically indicate the specific type of request, (e.g., request to delete, request to know categories of personal information, request to know pieces of personal information, or request to correct personal information).

Making a verifiable consumer request does not require you to create an account with us.

How to Exercise Consumer Right to Opt-out of Sale/Sharing or Right to Limit

To exercise the right to Opt-out of Sale/Sharing, or the Right to Limit, the consumer or its authorized agent may submit a consumer request to us by either:

Calling us at 1-800-843-2728 (1-800-THE-CRAV), or
To exercise their Right to Opt-Out of Sale or Sharing a consumer may utilize an Opt-out preference signal as described below, or click the, DO NOT SELL OR SHARE MY PERSONAL INFORMATION link in the footer of the Sites or through the settings menu of the App, or through the cookie shaped privacy tool, when visible, and

switch the Do Not Sell or Share My Personal Information toggle to the right, and
click save.

To exercise their Right to Limit a consumer may click the, LIMIT THE USE OF MY SENSITIVE PERSONAL INFORMATION link in the footer of the Sites or through the settings menu of the App, and
- switch the Limit the Use of My Sensitive Personal Information toggle to the right, and
- click save.

Opt-out Preference Signal

Some web browsers may allow consumers to transmit an opt-out preference signal through the websites, but not through the App. In addition to the above-described methods, a consumer may exercise its Right to Opt-Out of Sale and Sharing on our websites, but not through the App by enabling the global privacy control (“GPC”) opt-out preference signal before the consumer visits our websites.

The technical specifications of a consumer’s transmitted preference signal affect how we process the signal. By way of example, if a consumer utilizes a preference signal via a browser and that preference signal is associated solely with that consumer browser, the opt-out will be processed with respect to that browser in a frictionless manner.

The GPC is currently available on some internet browsers, like Mozilla Firefox, Duck Duck Go, and Brave, or as a browser extension. You may learn more about the GPC by visiting https://globalprivacycontrol.org.

Appeal

A consumer may appeal our actions in response to a request to exercise such rights by calling us at 1-800-843-2728 (1-800-THE-CRAV).

Accessibility

If you are experiencing website accessibility issues with our Privacy Policy, you may call 1-800-843-2728 (1-800-THE-CRAV) for assistance navigating the page on which the Privacy Policy is displayed, or to obtain a copy of our Privacy Policy in an alternative format.

NOTICE OF FINANCIAL INCENTIVE

CRAVER NATION® Rewards

The purpose of this Notice of Financial Incentive is to explain the material terms of the financial incentive or price or service difference White Castle offers to Consumers through the CRAVER NATION® Rewards program (“CRAVER NATION® Rewards”) so that you may make an informed decision about whether to participate. CRAVER NATION® Rewards is established for the genuine purpose of providing Rewards to Consumers that voluntarily participate in the program (“Participants”).

Incentive Summary and Material Terms

Participants in CRAVER NATION® Rewards may be provided various coupons, deals or other offers or points, which may be redeemed for products or product discounts, as applicable, through the App or at participating White Castle restaurants (“Castles”), as applicable (each such product or discount, when redeemed, a “Reward” and collectively, “Rewards”). The material terms of CRAVER NATION® Rewards are available in the Rewards Terms and Conditions available at this link.

Categories of Personal Information Collected Through CRAVER NATION® Rewards

The categories of personal information listed in the table below may be collected through CRAVER NATION® Rewards, and such information may be sold or otherwise shared for targeted advertising purposes to the categories of third parties listed in the table. The personal information collected through CRAVER NATION® Rewards will not be provided to data brokers.

Categories of Personal Information	Personal Information Sold or Shared	Categories of Third Parties
Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), including name, address, telephone number. Some personal information included in this category may overlap with other categories.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks
Protected classification characteristics under California or federal law, including an indication that Participant’s age is over 17, Participant’s date of birth and sex.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks
Commercial Information, Including products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks
Internet or other similar network activity, including with respect to a Participant’s browsing history, search history, and information on Participant’s interaction with the App, and certain White Castle Drive-thru experiences, or advertisements.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks
Geolocation data, including physical location or movements.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks
Inferences drawn from the above categories of personal information to create a profile reflecting a Participant’s preferences, characteristics, behavior, attitudes, and age.	Yes	advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social networks

How to opt-in?

Provided you meet the eligibility requirements, you may opt-in to CRAVER NATION® Rewards by downloading the White Castle App and ensuring you have the most up to date version on your device. Once you have the current version, ensure your location services are set to either “Always On” or “While Using App.” Then, when you are in a participating Region, a blue “CRAVER NATION® Rewards Join today to Earn Rewards” banner will appear on your App homepage. Click on the banner and it will prompt you to create an account by submitting your name, email address, zip code and other information, and join.

Right to withdraw

Participation in the CRAVER NATION® Rewards is voluntary. As a Participant, you may withdraw at any time by logging in to your CRAVER NATION® Rewards account in the App, and then

tap “settings” in the menu, then

tap “Edit Account Info,” then

tap to deselect (uncheck) “Enrolled in CRAVER NATION®,” and then

tap “UPDATE.”

Value

The value of CRAVER NATION® Rewards to the Participant is the value of the menu price or discount from such menu price for the applicable Reward, as applicable.

In the event a Participant exercises their right to opt-out of the sale or sharing of their personal information or limit the use of their sensitive personal information, or exercises their right to delete personal information, the value of the Rewards available to the Participant may be reduced accordingly. The Participant will continue to receive Rewards that are generally made available to all Participants through the App, but will not receive certain targeted Rewards such as birthday offers, or location-based offers, as such offers require such personal information and related use, and Participant may not be able to redeem certain offers through the App or in Castles where location verification is required.

White Castle may receive value from CRAVER NATION® Rewards; however, the value received by White Castle may vary considerably with respect to a specific Participant and with respect to all Participants depending on purchases made, Rewards redeemed, and other factors. In any event, we estimate in good faith that the value to White Castle of the personal information White Castle collects from CRAVER NATION® Rewards, when considering the expenses related to providing CRAVER NATION® Rewards and collecting and retaining the related personal information, is less than the value that CRAVER NATION® Rewards provides to Participants.

BIOMETRIC INFORMATION PRIVACY POLICY

Biometric Data Defined

As used in this Biometric Information Privacy Policy, biometric data includes “biometric identifiers” and “biometric information” as defined in the Illinois Biometric Information Privacy Act, 740 ILCS § 14/1, et seq. “Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.

“Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.

Biometric Information Data Storage

White Castle shall use a reasonable standard of care to store, transmit and protect from disclosure any paper or electronic biometric data collected. Such storage, transmission, and protection from disclosure shall be performed in a manner that is the same as or more protective than the manner in which White Castle stores, transmits and protects from disclosure other confidential and sensitive information, including personal information that can be used to uniquely identify an individual or an individual’s account or property, such as account numbers, PINs, driver’s license numbers and social security numbers.

Employee Biometric Data:

Purpose for Collection of Employee Biometric Data

White Castle collects, retains, and uses biometric data and/or information for the purpose of identifying an employee’s signature when utilizing White Castle’s proprietary software (“Employee Biometric Data”). Biometric scanners are computer-based systems that scan an employee’s finger for purposes of identification. The computer system extracts unique data points and creates a unique mathematical representation used to verify the employee’s identity, prevent fraud, and for pre-employment hiring purposes.

Employee Biometric Information Disclosure and Authorization

To the extent that White Castle collects, captures, or otherwise obtains biometric data relating to an employee, White Castle must first:

Inform the employee in writing that White Castle is obtaining the employee’s biometric data, and that White Castle is internally storing such biometric data;
Inform the employee in writing of the specific purpose and length of time for which the employee’s biometric data is being collected, stored, and used; and
Receive a written release signed by the employee (or his or her legally authorized representative) authorizing White Castle to collect, store, and use the employee’s biometric data for the specific purposes disclosed by White Castle (a “written release” may be collected digitally).

White Castle will not sell, lease, trade, or otherwise profit from employees’ biometric data.

Employee Biometric Information Disclosure

White Castle will not disclose or disseminate any Employee Biometric Data to anyone.

Employee Biometric Information Retention Schedule

White Castle shall retain Employee Biometric Data only during the course of the employee’s tenure with White Castle. White Castle permanently deletes/destroys such biometric data and/or information at the end of the calendar year during which an employee’s employment with White Castle ends.

A White Castle employee who utilizes a White Castle Drive-thru experience equipped with the JULIA AI voice assistant will be treated as a customer for purposes of this Disclosure.

Customer Biometric Data:

Purpose for Collection of Customer Biometric Data

As part of certain White Castle Drive-thru experiences equipped with the JULIA AI voice assistant, White Castle and its subcontractors, including without limitation SoundHound collect, store, share, and use Customer biometric data and/or information for the purpose of enabling, effecting, facilitating or fulfilling White Castle orders, and to improve, upgrade, or enhance the JULIA AI voice assistant experience by training machine learning models to better understand and respond to spoken words.

Customer Biometric Information Disclosure and Authorization

To the extent that White Castle collects, captures, or otherwise obtains biometric data relating to a Customer, White Castle must first:

Inform the Customer in writing that White Castle is obtaining the Customer’s biometric data, and that White Castle is internally storing such biometric data;
Inform the Customer in writing of the specific purpose and length of time for which the Customer’s biometric data is being collected, stored, and used; and
Receive a written release signed by the Customer (or his or her legally authorized representative) authorizing White Castle to collect, store, and use the Customer biometric data for the specific purposes disclosed by White Castle (a “written release” may be collected digitally).

White Castle will not sell, lease, trade, or otherwise profit from Customer biometric data.

Customer Biometric Information Disclosure

White Castle may disclose or disseminate an audio recording of your voice to SoundHound and its subcontractors.

JULIA AI Biometric Information Retention Schedule


Specific Piece of Solution Biometric Information	Processing Purpose	Length of Term (from the date of initial collection from the individual)
Audio recording	Enable, effect, facilitate or fulfill White Castle orders	28 Days
Audio recording	Improve, upgrade, or enhance the JULIA AI experience by training machine learning models to better understand and respond to spoken words	28 days
Non-Personal Data	Processing Purpose	Length of Term (from the date of initial collection from the individual)
Deidentified information that does not include a voiceprint and is not and may not be used to identify an individual	Improve, upgrade, or enhance the JULIA AI experience by training machine learning models to better understand and respond to spoken words	364 days

SoundHound and its subcontractors will permanently destroy the audio recording of your voice within the earlier of:

(i) the date the applicable initial purpose for collecting or obtaining such identifiers or information set forth above has been satisfied, or

(ii) within the applicable term set forth in the table above.

ACCESSING AND CORRECTING YOUR INFORMATION

For our food ordering Sites, you can review and change your personal information by logging into the Sites and visiting your account profile page.

You may send us an email at Privacy@whitecastle.com to request access to, correct or delete any personal information that you have provided to us. We cannot delete your personal information except by also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

If you delete your User Contributions from the Sites, copies of your User Contributions may remain viewable in cached and archived pages or might have been copied or stored by other users of our Sites. Proper access and use of information provided on the Sites, including User Contributions, is governed by our Terms and Conditions.

TRANSFER OF INFORMATION

The Sites and information provided on or through the Sites may be stored and processed in the United States, and is intended only for users located in the United States. If you are located in the European Union or elsewhere outside of the United States, please do not use the Sites or provide any information to us or otherwise through the Sites. Please be aware that information we collect will be transferred to and processed in the United States. By using the Sites or providing us with any information, you acknowledge any related transfer and the processing of information in the United States.

DATA SECURITY

The security of your personal information is important to us. We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure.

The safety and security of your information depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Sites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Sites. The information you share in public areas may be viewed by any user of the Sites.

Unfortunately, the transmission of information via the internet is not completely secure. We cannot guarantee the security of your personal information transmitted to our Sites. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Sites.

CHANGES TO OUR PRIVACY POLICY

We reserve the right to change our Privacy Policy from time to time. If we make material changes to how we treat our user’s personal information, we will notify you by updating the Effective Date of this Privacy Policy and placing a banner on the main page of our Sites indicating that changes were made. Your continued use of our Sites following the posting of changes constitutes your acknowledgement of such changes.

HOW TO CONTACT US

For other information or questions regarding changing information that we have about you, please contact us at 1-800-843-2728 (1-800-THE-CRAV), or click on the “Contact Us” / “General Feedback” link located on our Sites. You may also reach us at:

White Castle Management Co.
555 Edgar Waldo Way
Columbus, OH 43215