ANDRE-BOUDIN BAKERIES, INC.

PRIVACY POLICY

Updated on June 28, 2023

ANDRE BOUDIN BAKERIES, INC. (referred to here as “we,” “our,” or “Boudin”) is committed to protecting your privacy.  This Privacy Policy (“Policy”) applies to our offline and online data collection practices, including when you visit or use our website  www.boudinbakery.com and any other website owned or operated by us (the “Website”), mobile app, participate in our online community (“online services”), purchase or inquire about our products and services, subscribe to our mailing lists, visit our store, use our Wi-Fi, sign up for our loyalty program or sweepstakes/contests, engage with us on social media websites or otherwise interact with us in any manner (collectively, our “Services”).  Our intent is to be transparent about our practices regarding collection, use and disclosure of personal information.

We may update this Policy from time to time, as specified in the “Changes to This Privacy Policy” section below.

EU residents have certain rights related to personal data. If you are a resident of the EU, please click here.

California state law confers certain rights relating to personal information to its residents. If you are a California resident please see our California Privacy Notice at boudinbakery.com/ccpa.

Please note the arbitration provision set forth below, requiring you to arbitrate any claims you may have against Boudin on an individual basis.

ARBITRATION ON AN INDIVIDUAL BASIS MEANS THAT YOU WILL NOT HAVE, AND YOU WAIVE, THE RIGHT FOR A JUDGE OR JURY TO DECIDE YOUR CLAIMS, AND THAT YOU MAY NOT PROCEED IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE CAPACITY.

YOUR CONSENT

You should read this entire Policy before submitting personal information to us in any form including the Website, our online services, and Services.  Whenever you submit personal information to us, you consent to the collection, use disclosure, transfer and storage of that information in accordance with this Policy.

We may make full use of all information that is de-identified, aggregated, or otherwise not in personally identifiable form.

TYPES OF INFORMATION COLLECTED

We collect personal information about you in the following ways: 1) from you when you choose to voluntarily provide it; 2) using automated technology, including when you visit our Website, online services, stores, or interact with our electronic advertisements or communications; and 3) third party sources, including but not limited to service providers, analytics providers, social media and social networking websites and other entities.  Automated technology collects information from your computer or mobile device and includes cookies, web beacons, local shared objects, or other similar technology.  More information is given in the “Cookies and Other Technology” section below.

All personal information may be used for the purposes stated in this Policy. We may combine data collected from third party sources. To see a complete list of what we collect and how we use this data, please see Annex 1.

Personal Information

We collect the following personal information from consumers:

• Personal details, such as first name and last name, billing address, date of birth, email address, and telephone number;
• Billing information, such as credit card information and payment details;
• Profile information, including products and services you like, times you visit our websites or mobile apps, your favorite store location, and any other information you choose to provide to us when you interact with us;
• Internet Protocol (“IP”) address, mobile or computer device ID, browser type, browser version, unique device identifiers including advertising identifiers, domain names, referring website addresses and other diagnostic data from your use and interaction with our online services including but not limited to the pages you visit on our Website or in our mobile apps, time you spend on those pages, and the time and date of your visit; and

USE OF INFORMATION

We use personal information about customers for a wide range of purposes.  We use it to:

• respond to your requests;
• to provide products or services that you have ordered;
• to process your order transactions and contact you regarding your order, purchases or accounts with us, requests, questions and comments;
• to allow you to post information and other content online;
• to provide and monitor the online services we provide to you;
• to provide location-based services such as delivery, location based promotions and events;
• to improve our products, online services and Services and manage our business such as fraud prevention purposes, determining usage pattern of our consumers, complying with legal obligations, establishing, exercising or defending a legal claim, monitoring and reporting compliance issues;
• to follow up with you after you have communicated with us or submitted information to us;
• for analytics and profiling technology to customize your experience, statistical purposes, deliver content (including advertising) tailored to your interests and how you use our online services, to market to you through targeted advertising;
• to improve our business including our Website, online services, Services, selections, customer service, shopping experience;
• to send promotional communications or offers to you by mail, email, telephone, or text message or other means (unless you have requested that we not send such communications);
• to help improve the features and functionality of our Website, online services and Services;
• for marketing, research and legal purposes and other purposes (including, without limitation, call center recordings); to address your interests and concerns; and
• as otherwise specified in this Policy and/or at the point of collection of the personal information.

OTHERS WITH WHOM WE MAY SHARE YOUR INFORMATION

Service Providers.  We may disclose personal information you provide to our consultants, service providers, contractors that we use to support our business and operations who have agreed to keep the information confidential and use it only to provide the applicable service(s).  For example, we may share information with vendors that assist us with communicating with you, hosting our website, processing credit card payments, HR management, etc.

Third Party Partners.  We also share your information with third party companies who provide us with analytics, advertising, and online behavioral marketing services such as social networking websites like Facebook, Instagram, Twitter, and Google.

Legal Obligations.  We may disclose personal information to third parties (including, without limitation, governmental agencies) if required to do so by law, regulation or court order; to respond to governmental and/or law enforcement requests; to identify, contact or bring legal action against someone who may be causing injury to or interfering with our (or others’) rights or property; to support any actual or threatened claim, defense or declaration in a case or before any jurisdictional and/or administrative authority, arbitration or mediation panel; or in connection with disciplinary actions/investigations.

Sale or Corporate Restructuring.  We may also disclose personal information to third parties in connection with the sale, assignment or other transfer of the business of our website or the sale, assignment, merger, reorganization or other transfer of our brand or company.

We may make full use of all information that is de-identified, aggregated or otherwise not in personally identifiable form.  We may also make full use of all user-generated content you submit to us.

HOW WE USE COOKIES AND OTHER TECHNOLOGY

As you enter the Website, our server records and monitors your IP address and uses it to develop statistical analysis.  These analyses assist us in refining and adapting the content and design of our site.  The use of IP addresses also enables us to prevent malicious Internet users from masquerading as other users.  Automated technology collects information from your computer or mobile device and includes cookies, web beacons, local shared objects, or other similar technology.  A cookie is a small piece of information sent by a website that is saved on your hard drive by your computer’s browser.  A “web beacon” is a small object or image that is embedded into a web page, application, or email and is used to track activity.  They are also sometimes referred to as pixels and tags.

As you access or use our Website, we and/or third parties may collect information using cookies, web beacons, pixels, and navigational and location data collection (clickstream, log files, server logs) for the purposes described in this Policy.  Such automated technologies further help us to keep track of your interactions with our website and provide you with a more customized experience.

To learn more about cookies visit www.allaboutcookies.org.  Most browsers are initially set to allow cookies, but also offer the option to restrict cookies or warn you of their use.  By disabling cookies, you won’t be able to enjoy the convenience provided by our customization.

THIRD PARTY ANALYTICS AND ADVERTISING DISCLAIMER

We and/or third-parties including advertising companies, social networking sites, and service providers on our behalf, use cookies, web beacons and other similar technology, to collect information for the purposes described in this Policy including advertising, analytics, online behavioral marketing, monitoring performance and improvement of our online services (traffic, errors, page load time, popular pages, etc.).

If you are a resident of the European Economic Area (EEA), you have the right to opt-out of decisions based solely on automatic decision-making, such as certain types of behavioral remarketing.

Below are ways in which you can opt-out of each remarketing service:

Analytics

Google Analytics and Meta Pixel:  We use Google Analytics, Meta Pixel and The Trade Desk to understand how our website, services, and products perform, how you use them, and to serve you with ads on third-party websites and social networking sites like Facebook.  To learn more about how Google processes your data, please visit https://www.google.com/policies/privacy/.  To opt out of Google Analytics please visit https://tools.google.com/dlpage/gaoptout.  To learn more about how Facebook uses your data, please visit https://www.facebook.com/policy.php.  To learn more about how The Trade Desk uses your data, please visit https://www.thetradedesk.com/us/privacy, and to opt out, please visit https://www.adsrvr.org/.

Advertising and Behavioral Remarketing

We use remarketing services to advertise on third-party websites to you after you visit our Website, applications, and other online services.

Facebook:  To understand more about Facebook advertising and manage your preferences, please visit https://www.facebook.com/about/ads.  Login to Facebook and go to Settings > Ads > Ad Settings (web) or Ad Preferences > Ad Settings (app) for more information.

Instagram: To learn more about Instagram Ads and to exercise your choices please visit: https://help.instagram.com/478880589321969

Google:  To opt out of Google Ads, please visit https://www.google.com/settings/ads/anonymous.

For more information about targeted advertising and to opt out of collection of information and ad targeting from third-party websites, including Facebook and Google, please visit http://www.aboutads.info/choices.  If you choose to opt out, you will continue to receive advertisements but they will not be tailored to your interests.

This Policy does not apply to, and we are not responsible for, third-party cookies, web beacons, or other tracking technologies, which are covered by such third parties’ privacy policies. For more information, we encourage you to check the privacy policies of these third parties to learn about their privacy practices.

LINKS TO OR FROM ANOTHER WEBSITE

Our Website, online services, and Services may contain links to other websites not operated or controlled by us (the “Third Party Sites”). All data provided, collected, maintained, stored or otherwise disclosed on these Third Party Sites, if any, is governed by their privacy policies. The links on the Website do not imply that we endorse or have reviewed the Third Party Sites, or their privacy policies, if any. We strongly encourage you to contact those sites directly for information on their privacy policies.

If you have accessed the Website through a link from certain of our advertising or marketing partners, the Website may include a frame of the applicable advertising or marketing partner. Nevertheless, the information you provide to us through these framed web pages is collected by us, and our use of such information is governed by this Policy.

Legal Basis for Processing Personal Data and Information Under the General Data Protection Regulation (GDPR)

If you are a resident of the European Economic Area (EEA), Boudin’s legal basis for collecting and using the personal information described in this Privacy Policy (under the GDPR, the “Personal Data”) depends on the personal information we collect and the specific context in which we collect it.  In addition, we process personal information with the principle of data minimization in mind.  This means that we limit ourselves to the minimum amount of personal information which is needed to achieve the particular purpose for which we process the personal information.  Below are some examples of the purposes for which personal information may be processed.

Boudin may process your personal information because:

• The processing is necessary to provide the services and features you have requested;
• The processing is necessary to protect the vital interests of our users or of others;
• The processing is necessary to perform a contract with you;
• The processing is necessary for the legitimate interests of our business, such as fraud prevention, information security, or to comply with the law;
• You have provided consent for us to do so.

Your Personal Information Protection Rights and Choices

If you are a resident of the European Economic Area (EEA), you have certain data protection rights.  You have choices about how we use and retain your personal information.  Boudin has implemented reasonable steps to allow you to correct, amend, delete, or limit the use of your personal information.

If you wish to be informed of the type of personal information we hold about you and/or if you wish to remove such personal information from our systems, please contact us at privacy@boudinbakery.com.

You have the following personal information protection rights:

The right to access, update or delete the personal information we have on you.  In many instances, you can personally access and update your personal information by accessing your online account settings.  If you are unable to perform these actions yourself, please contact us to assist you.

The right of rectification.  You have the right to have your personal information corrected if that information is inaccurate or incomplete.

The right to object.  You have the right to object to our processing of your personal information.

The right of restriction.  You have the right to request that we restrict the processing of your personal information.

The right to data portability.  You have the right to be provided with a copy of the personal information that we have on you in a structured, machine-readable and commonly used format.

The right to withdraw consent.  You have the right to withdraw your consent at any time where Boudin relied on your consent to process your personal information.

You also have the right to not be discriminated against for exercising your privacy rights.

Please note that for your safety and security, we may ask you to verify your identity before responding to such requests.

CROSS BORDER DATA TRANSFERS

Your personal information may be transferred to—and maintained on—computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside of the United States and choose to provide information to us, please note that we transfer the information, including your personal information, to the United States and process it there. Data protection laws in the U.S. may be different from those in your country of residence. You consent to the transfer of your information, including personal information, to the U.S. as set forth in this Privacy Policy by visiting our website or using our Services.

DISCLOSURE OF PERSONAL INFORMATION FOR LAW ENFORCEMENT

Under certain circumstances, Boudin may be required to disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

RETENTION OF PERSONAL INFORMATION

We will retain your personal information (collected through offline and online methods) for as long as it is necessary for the purposes set out in this Policy.  We will retain and use your personal information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your personal information to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. For more information regarding retention of personal information, please see Annex 1.

INTENDED AUDIENCE; COPPA COMPLIANCE

We are in compliance with the requirements of the Children’s Online Privacy Protection Act (“COPPA”).  Our Website, online services and Services are not directed to children under the age of 13.  As a result, we do not request or knowingly collect personal information from individuals under the age of 13.  If you are not 14 or older, you should not visit or use our Website or Services, including online services.

SECURITY

We take appropriate steps to protect personal information from loss, misuse and unauthorized access, disclosure, alteration or destruction, whether in transmission or storage.  Please keep in mind, however, that there is no such thing as perfect security, and no Internet transmission is ever completely secure or error-free.  Moreover, you are responsible for maintaining the confidentiality of any user name and password you use.

We offer the use of a secure server.  All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology hosted by a third party and then encrypted into our payment gateway provider’s database only to be accessible by those authorized with special access rights to such systems, and who are required to keep the information confidential.

After a transaction, your sensitive Personal Information (credit cards, social security numbers, etc.) will not be stored on our servers. Although we strive to protect your personal information in accordance with this Policy, we will not be liable for disclosure of personal information obtained due to errors in transmission or security breaches.

CONTACT PREFERENCES; OPT-IN AND OPT-OUT

We would like to keep in touch with you in ways that you find to be beneficial.  If you don’t want us to use your contact information to communicate with you for promotional purposes, please tell us that when you provide your contact information.  If at any time you would like to unsubscribe from receiving future emails, you can click the unsubscribe link at the bottom of any email.  You may also contact us at privacy@boudinbakery.com.  Keep in mind that these preferences regarding promotional contacts do not mean that we might not contact you for other reasons, such as those related to an order you placed, an inquiry you made, a legally required notice and so on.

ARBITRATION; CLAIMS MUST BE BROUGHT ON AN INDIVIDUAL BASIS

By using the Website, online services, and Services, you agree that any dispute in any manner arising out of or relating in any way to this Policy, its enforcement or interpretation, or because of an alleged breach, default, or misrepresentation in connection with any of its provisions, shall be submitted to binding arbitration with Judicial Arbitration and Mediation Services, Inc. (“JAMS”) in the San Francisco, California area.  ARBITRATION MEANS THAT YOU WILL NOT HAVE AND YOU WAIVE THE RIGHT FOR A JUDGE OR JURY TO DECIDE YOUR CLAIMS.  Rights to the prehearing exchange of information and other discovery, as well as appeal rights, are more limited than were you to sue in court.

This arbitration provision is equally binding on claims brought by us as on claims brought by you or others.  Arbitrations will be conducted under the applicable JAMS rules.  The parties to arbitration will have all the same claims, legal rights, and remedies in arbitration that would be available in court.  A single neutral arbitrator shall be selected in accordance with the JAMS Streamlined Arbitration Rules, which shall provide you a reasonable opportunity to participate in the arbitrator selection.  It is further agreed that any disputes as to whether the scope of this arbitration provision covers the claim will be submitted to the arbitrator, and not a court, for decision.  The parties to arbitration will have full right to use legal counsel at their own expense.  All costs of arbitration (including arbitrator fees) shall be paid by us, except if you bring the arbitration, you may be charged an initial filing fee that shall not exceed the filing fees that you would incur for bringing an action in court.  You will not be required to pay fees and costs incurred by the opposing parties if you do not prevail in arbitration.  In arbitration, the parties may conduct reasonable discovery and shall reasonably exchange non-privileged information relevant to the dispute.  The arbitrator’s award shall be in writing and provide a written statement of the essential findings and conclusions.  The arbitrator will not have the power to commit any error of law or legal reasoning, and the award may be vacated or corrected on appeal to a court of competent jurisdiction for any such error.  As an exception to this arbitration provision, no one subject to the provision will be precluded from seeking remedies for disputes or claims less than $10,000 in the aggregate that can be brought in a court of competent jurisdiction.

ANY ARBITRATION SHALL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE CAPACITY.  It is expressly understood and agreed that neither you nor we are entitled to arbitrate or bring any dispute covered by this arbitration provision as a class, consolidated, representative, collective, or private attorney general action, and the arbitrator(s) will have no authority to proceed on a class, consolidated, representative, collective, or private attorney general action basis.  This means:

• You cannot bring a claim as a plaintiff or class member in a class action, consolidated action or representative action.
• The arbitrator cannot combine more than one person’s claim into a single case, and cannot preside over any consolidated, class or representative arbitration proceeding (unless we both agree to change this).
• The arbitrator’s decision or award in one person’s case can only impact the person who brought the claim, not other Boudin customers, and cannot be used to decide other disputes with other customers.

If any part of the agreement to arbitrate in this section is found unenforceable, the unenforceable term will be severed and the remaining arbitration terms will be enforced (but in no case will there be a class, representative or private attorney general arbitration).  In the event that any of the class action restrictions are ever deemed illegal or unenforceable, the illegally deemed or unenforceable restriction(s) shall be severed from this arbitration provision, and any class action shall be exempted from this arbitration provision and brought in court.  This arbitration provision is subject to the Federal Arbitration Act, and may be enforced in any court of competent jurisdiction.

DATA PROTECTION OFFICER AND QUESTIONS

For information and questions about the use of your personal information or this Privacy Policy, you may contact our Data Protection Officer at privacy@boudinbakery.com.

CHANGES TO THIS PRIVACY POLICY

This Policy may be revised from time to time for any reason.  If this Policy changes, the revised policy will include a new effective date, and we will notify you of such changes by posting the revised policy on this page.  Be sure to check the Privacy Policy whenever you submit personal information to us through the Website, online services, or Services.  The effective date of this Policy is June 28, 2023.