ANDRE BOUDIN BAKERIES, INC.

CALIFORNIA CONSUMERS ONLY:

YOUR CALIFORNIA PRIVACY RIGHTS

Updated on May 18, 2026 

This Privacy Rights Act Notice (“Notice”) provides additional information to California residents whose Personal Information is collected by us pursuant to California law, including the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).  If you are not a California resident, this Notice does not apply to you.  Please visit our Privacy Policy (“Policy”) boudinbakery.com/privacy-policy for more information.  Any capitalized terms undefined in this Notice have the same definition as the Policy.  The terms “Website,” “online services,” and “Services” and any undefined terms will have the same meaning as defined in our Privacy Policy.

PERSONAL INFORMATION COLLECTED, DISCLOSED, OR SOLD

Information Collected

Within the past 12 months, we have collected the categories of personal information about California consumers as described in Annex 1 to this Notice.  To review these categories click here: Annex 1.

Business-to-Business (“B2B”) Information

If you are a contact person for any of our business partners, vendors, distributors, suppliers, service providers, contractors, or other entities with which we have a business relationship or potential business relationship, you have the same rights as other consumers set forth in this Notice with respect to the information we collect from you in that role.  We collect the contact information you provide to us, including name, phone number, address, email address and other contact and relationship information and communications consistent with your role in facilitating that business relationship.  We use that information for internal purposes, including to contact you, send and receive information, and otherwise facilitate the business relationship.  We do not disclose that information outside our business relationship without your consent.  For more details see Annex 1.

Information Sold or Shared

As explained in Annex 1 of this Policy, we share your data with third-party partners such as social networking sites and advertising companies in order to serve you with ads tailored to your preferences across various platforms.  This type of sharing may be considered “selling” or “sharing” under the CPRA.  You can control the information shared about you and request an opt-out as explained below.

We have sold or shared the following categories of personal information for a business or commercial purpose in the preceding 12 months.

• Personal Identifiers
• Commercial Information
• Internet Activity

We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding 12 months:

• Personal Identifiers
• Commercial Information
• Internet Activity
• Biometric Data

We do not knowingly sell the personal information of individuals under 16 years of age without affirmative authorization.

For details regarding the categories of third parties with whom we have shared, sold, or disclosed personal information, please see Annex 1.

CPRA RIGHTS AND REQUESTS

Under the CPRA, you are entitled to certain rights, and you can make requests with regard to those rights as follows:

Right to Know about the Categories of Personal Information Collected (“Right to Know”)

Right to Request Deletion of Personal Information (“Right to Delete”)

Right to Correct or Rectify Inaccurate Information about you (“Right to Correct”)

HOW TO MAKE YOUR REQUESTS TO KNOW, DELETE, OR CORRECT

You have the right make requests for the aforementioned rights (Request to Know; Request to Delete; or a Request to Correct (a “Request”)).

To make a Request for any of the information set forth above, please submit a verifiable consumer request pursuant to the instructions below. The Request must provide sufficient information to allow us to verify that you are the person about whom the personal information was collected, sold, shared, or disclosed and must contain sufficient detail to allow us to properly understand, evaluate and respond to your request.  If we cannot verify your identity, we will not be able to respond to your request. We will acknowledge your Request within 10 business days and will attempt to respond substantively within 45-90 days.

You may make a Request the following ways:

• You may make a request here: privacy@boudinbakeries.com
• Enter your request here.
• You may also make a request by phone by contacting us at 1-833-754-1849.

Once we receive your Request to Know, we will begin the process to verify that you are the person that is the subject of the request (the “Verification Process”).  The Verification Process consists of matching identifying information provided by you with the information we have about you in our records.  You will be asked to provide us with two or three pieces of information that will help us to verify your identity.

We will review all information provided by you to us, to determine whether we can respond to your Request  We will inform you of our decision to deny or grant your Request.

For any Requests to Know, you may make such Requests twice within a 12-month period.

For Requests to Correct, you will need to provide evidence supporting the inaccuracy of the current information, and we reserve the right to delete the information instead of correcting if such deletion does not impact you or you consent to the deletion.

We will retain correspondence, documents and information related to any Request for 24 months as required by law.

ADDITIONAL CPRA RIGHTS

The following are additional rights afforded to you under the CPRA.

Right to Know Sensitive Personal Information Collected

We do not collect or process sensitive personal information for the purpose of inferring characteristics or for any purposes other than those set forth in Regulations section 7027(m).

Right to Opt out of Selling or Sharing

To opt out of selling or sharing of your personal information , click here.

RIGHT TO NON-DISCRIMINATION FOR EXERCISING CONSUMER PRIVACY RIGHTS

You have the right not to receive discriminatory treatment for exercising your privacy rights conferred by the California Consumer Privacy Act, including by exercising the rights specified herein.

Opt-out Preference Signals

We honor opt-out preference signals that you enable, including a Global Privacy Control.  Opt-out preference signals are plug-ins available in certain browsers that signal to websites you visit of your preferences to opt out of the sale and sharing of certain personal information. If you have enabled an opt-out preference signal device from your browser, we will not sell or share your personal information without first seeking your explicit consent.

We honor opt-out preference signals that you enable, including a Global Privacy Control. Opt-out preference signals are plug-ins available in certain browsers that signal to websites you visit of your preferences to opt out of the sale and sharing of certain personal information.  If you have enabled an opt-out preference signal device from your browser, we will not sell or share your personal information without first seeking your explicit consent.

COOKIES

As explained in our “Automatic Data Collection” section under subsection “Cookies,” you can opt out of cookies using your browser.

Please Note:

• Opt-outs are device and browser based. You must opt out on each device and each browser where you want your choice to apply.
• Opt-outs maybe stored via cookies. If you clear cookies, your opt-out may no longer be valid and you must opt out again where you want your choices to apply.
• We may still share your information with our service providers that help us perform functions that are necessary for our business such as vendors that host our website, credit card processors, analytics processors. These entities are contractually obligated to keep this information confidential and not use it for any purpose other than for the services they provide to our business.
• You may still receive ads from us that are not tailored to your interests.

ADDITIONAL OPTIONS TO OPT-OUT OF SALE OR SHARING

In addition to the above options to opt out of the “sale” or sharing of your information under the CCPA as described above, you have controls and choices with respect to collection and use of your information by third parties.  These are summarized for you below.  We do not control or maintain opt-out mechanisms for third party companies and are not responsible for their operation.

ADVERTISING OPT OUT

You can opt out of sharing your information with third-party companies engaged in targeted advertising including social networking sites such as Google, Twitter, Facebook, Snapchat, and TikTok using the following tools: For websites:  https://optout.aboutads.info.  For mobile apps: http://www.aboutads.info/appchoices.

GOOGLE OPT OUT

If you are on the web, you can opt out of Google Analytics by installing Google’s Opt-Out browser add on: https://tools.google.com/dlpage/gaoptout and opt out of interest-based Google ads using https://adssettings.google.com/u/0/authenticated.

FACEBOOK AD PREFERENCES

To understand more about Facebook advertising and manage your preferences, please visit https://www.facebook.com/about/ads.  Login to Facebook and go to Settings > Ads > Ad Settings (web) or Ad Preferences > Ad Settings (app) for more information.

TIKTOK OPT-OUT

To understand more about TikTok advertising and manage your preferences, please visit the TikTok Ad Settings page [LINK https://support.tiktok.com/en/account-and-privacy/personalized-ads-and-data/how-your-ads-are-personalized]. You can also turn off interest-based ads from TikTok by adjusting your device settings or visiting the TikTok app’s privacy settings directly.

SNAPCHAT

To understand more about Snapchat advertising and manage your interest-based ads and preferences, please visit the Snapchat Privacy Choices at https://help.snapchat.com/hc/en-us/articles/11399265637012-Your-Privacy-Choices-on-Snapchat.

THE TRADE DESK

To learn more about how The Trade Desk uses your data, please visit https://www.thetradedesk.com/us/privacy, and to opt out, please visit https://www.adsrvr.org/.

RIGHT TO ACCESS INFORMATION ABOUT AUTOMATED DECISION MAKING AND THE RIGHT TO OPT-OUT OF AUTOMATED DECISION MAKING

You can request access to information about automated decision making processes we use and you may request to opt out of certain automated decision making.  We do not engage in automated decision making or profiling that produces legal or similarly significant effects.

NOTICE OF FINANCIAL INCENTIVE

From time to time, Boudin may provide financial incentives to consumers who elect to participate in these programs and, in connection with such programs, allow us to collect and retain certain personal information, such as Identifiers (e.g., your name, email address, or phone number) and Commercial Information (e.g., your purchase history).  These incentives may result in differences in the prices of our products offered to consumers (e.g., discounts and other promotions).  For example, the financial incentives we may provide include discounts based upon purchase activity other periodic discounts for promotional purposes.

The material aspects of any financial incentive will be explained and described in its program terms or in the details of the incentive offer.

Participation in any financial incentive program is entirely optional and participants may withdraw from the program at any time. To opt-out of the program and forgo any ongoing incentives, please follow the instructions in the program’s terms and conditions, or contact us please email us at privacy@boudinbakery.com.

The value of your personal information that allows us to make these offers and financial incentives is the value of the offer itself.  Each financial incentive or price or service difference related to the collection and use of personal information is calculated based upon our reasonable, good-faith determination of the estimated value of such information to our business, taking into consideration the value of the offer itself, the expense associated with the offer, and the anticipated revenue generation that may be realized by rewarding brand loyalty and repeat purchases.

RETENTION OF PERSONAL INFORMATION

We will retain your Personal Information for as long as it is necessary for the purposes set out in Annex 1 and to the extent necessary to comply with our legal obligations (for example, if we are required to retain your Personal Information to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

AUTHORIZED AGENT INFORMATION

You may designate an authorized agent to make a request on your behalf under the California Consumer Privacy Act.

In order to allow an authorized agent to make a request on your behalf, please email us at privacy@boudinbakery.com to provide your written request and consent to an authorized agent.

When your authorized agent makes a request related to your personal information, we will require the agent to provide the above written permission.  We may also require that you verify your own identity directly with us at the time such a request is made. We reserve the right to deny requests in certain circumstances, such as where we have a reasonable belief that the request is fraudulent.

CALIFORNIA DO NOT TRACK NOTICE

Because there are not yet common, industry accepted “do not track” standards and systems, our website does not respond to Do Not Track signals.  In addition, we may allow additional third parties to collect personal information from your activity on our website, as described in the “Information Collection and Use” section above and as described in Annex 1.

CALIFORNIA SHINE THE LIGHT DISCLOSURE INFORMATION

Although we do not disclose to any third parties for their direct marketing purposes any personal information, California residents are entitled to receive the following disclosure information under California law:

Under California Law, California residents have the right to request in writing from businesses with which they have an established business relationship, (1) a list of the categories of personal information, such as name, address, e-mail address, and the type of services provided to the customer that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes, and (2) the names and addresses of all such third parties.  We will respond to such written requests within 30 days following receipt at the e-mail or mailing address specified below under “Contact Us.”  If we receive your request at a different e-mail or mailing address, we will respond within a reasonable period of time, but not to exceed 150 days from the date received.  Please note that we are required to respond to each customer only once per calendar year

CHANGES TO THIS PRIVACY POLICY

This Policy may be revised from time to time for any reason. If this Policy changes, the revised policy will include a new effective date, and we will notify you of such changes by posting the revised policy on this page. Be sure to check the Policy whenever you submit personal information to us.

CONTACT FOR MORE INFORMATION

For information and questions about the use of your personal information or this California Consumer Privacy Act Notice or your rights under California law, you may contact our Data Protection Officer at privacy@boudinbakery.com or by calling 1.833.754.1849.