California Privacy Policy

California Addendum – California Consumer Privacy Policy  

If you are a California consumer, the following provisions apply to our processing of information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“California Personal Information”). For California consumers, the provisions of this California Addendum prevail over any conflicting provisions in other sections of this Privacy Policy. We share, and in the past 12 months have shared California Personal Information such as California residents’ use of our Online Services with our marketing and advertising partners for cross-contextual advertising purposes as further described below. Otherwise, we do not sell, and in the past 12 months we have not sold, California Personal Information. Additionally, we do not sell or share, and in the past 12 months we have not sold or shared, California Personal Information of individuals we know to be under 16 years of age.

We have collected the following categories of California Personal Information within the last 12 months from the sources listed below:

(a) Identifiers, such as a real name, physical address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. This category of information is collected from you, your devices, and third parties such as Linked Sites, your family and friends, Franchised Operators and Licensees, and public databases.

(b) Personal information described in subdivision (e) of Section 1798.80 (California customer records statute), such as a name, address, telephone number, credit card number, debit card number, or other payment information. This category of information is collected from you, your devices, other CFA Group entities, Franchised Operators and Licensees or other third parties such as our business partners.

(c) Characteristics of protected classifications under California or federal law such as age, gender, race, ethnicity or national origin. This category of information is collected from you when you choose to provide it to us directly or indirectly through our service providers and business partners as part of our surveys and market research.

(d) Commercial information, including products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. This category of information is collected from you, your devices, other CFA Group entities, Franchised Operators and Licensees or other third parties such as our business partners.

(e) Internet or other similar network activity, including, but not limited to, browsing history, search history, browser settings like language preference, and information regarding a consumer’s interaction with a website, application, or advertisement. This category of information is collected from you and your devices.

(f) Geolocation data, including physical location or movements. This category of information is collected from you and your devices.

(g) Sensory data, including electronic, visual, or similar information. This category of information, such as photos, is collected from you and third parties such as Linked Sites, CFA Group entities, our service providers, or Franchised Operators and Licensees.

(h) Inferences, such as a profile about a consumer’s preferences, characteristics, and behavior, drawn from information we collect and insights we receive from third parties such as our marketing and advertising partners and data analytics providers.

(i) Sensitive personal information, such as account login information allowing access to an account, precise geolocation data, race, and ethnicity, in each case as further described above in the relevant categories. If you win a promotional prize or sweepstakes, we may also collect your W9 information, including FEIN or SSN for legal compliance. Please note we do not collect sensitive personal information for the purpose of inferring characteristics about you.

Please see the “Information You Provide to Us" and "Information We Collect Automatically or from Others” Section to learn more about the types of information we collect and how we collect them. We retain each category of California Personal Information as described in the “Retention” section of the Privacy Policy.

For each of the above categories, we use the California Personal Information for a variety of business purposes such as:

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
• Helping to ensure security and integrity to the extent the use of a consumer's personal information is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors in our systems;
• Short-term, transient use including contextual non-personalized advertising shown as part of a consumer’s current interaction with us; 
• Providing services on our behalf or on behalf of another, including maintaining or servicing accounts, providing customer service, fulfilling transactions, verifying identity information, processing payments, and other services;
• Conducting internal research to develop and demonstrate technology;
• Conducting activity to verify, enhance, and maintain the quality or safety of services or devices which we may own, control, or provide;
• Providing the rewards and other perks that come from being a member of the CFA One^® Program.  More information on how we use personal information as part of the CFA One^® Program is available in the Notice of Financial Incentive Section;
• Other business purposes described in the “How We Use Your Information” Section.

We may also use the information we collect for our own or our service providers’ other operational purposes, purposes for which we provide you additional notice, or for purposes compatible with the context in which the California Personal Information was collected.

Within the last 12 months, we have disclosed California Personal Information for our business purposes. To learn more about the categories of third parties with whom we share such information, please see the “How We Disclose Your Information” Section.

Your California Privacy Rights

If you are a California consumer, you have certain rights related to your California Personal Information, including:

• The Right to know what California Personal Information we have collected about you, including the categories of personal information, the categories of California Personal Information,
• the categories of sources from which the California Personal Information is collected,
• the business or commercial purpose for collecting, selling, or sharing California Personal Information,
• the categories of third parties to whom we disclose California Personal Information, and the specific pieces of California Personal Information we have collected about you.
• The right to correct inaccurate California Personal Information that we have collected about you.
• The right to delete California Personal Information that we have collected from you, subject to certain exceptions. For example, we may not be able to delete your information when you have an unused gift card balance on your CFA One mobile app account.  If you have an unused gift card balance on your CFA One mobile app account and would like to understand options available to you, please contact our CARES center at 1-866-232-2040.
  • Please note, processing your deletion request will result in the elimination of your CFA One account, which will also limit your ability to utilize the full suite of features available in the Chick-fil-A App. Terminating your CFA One account will also result in the loss of earned points and unredeemed rewards.  
• The right to opt out of the sale or the sharing of California Personal Information.
  • We do not sell California Personal Information, but if you wish to opt out of the sharing of California Personal Information for cross-context behavioral advertising, please visit our Cookie Preference Center, located in the footer of Chick-fil-A.com.
• The right to limit the use or disclosure of your sensitive personal information. 
  • We do not use or disclose sensitive personal information for purposes that, under applicable law, require us to support the right to limit the use or disclosure of sensitive personal information.
• The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by applicable law, including the right not to be retaliated against for the exercise of your rights.
  • We will not discriminate against you for exercising your privacy rights. As further detailed in the below Notice of Financial Incentives, however, we may make different offers available to customers that have opted into a financial incentive.  The value of the financial incentive to you will reasonably relate to the value of your California Personal Information.

You may request to exercise these rights by:

• Calling us toll-free at Chick-fil-A CARES (1-866-232-2040); or
• Completing our privacy rights request form here.

As required under applicable law, we will take steps to verify your identity before granting you access to information or acting on your request to exercise your rights. We may require you to provide your first name, last name, email address, the amount of your last transaction and the date of your last transaction to verify your identity in response to exercising requests of the above type. We may limit our response to your exercise of the above rights as permitted under applicable law. When you submit a request to exercise your rights above, we will use the information you provide to process your request and to maintain a record of your request and our response, as permitted under applicable law.

Under California law, you may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. We will require the agent to provide proof of that written permission. To the extent permitted by law, we may require you to verify your own identity in response to a request, even if you choose to use an agent. 

If you are an authorized agent submitting a request on behalf of a California consumer, please complete our privacy rights request form available here. 

Notice of Financial Incentives

This Notice of Financial Incentives applies to the Chick-fil-A One^® loyalty program (the “Program”). We reserve the right to add financial incentives to this Notice of Financial Incentives and to terminate the Program at any time at our sole discretion. 

Chick-fil-A One^® Program Details 

Summary of the Incentives 

 Your account receives points on qualifying purchases at eligible restaurants. Points are accumulated to get rewards that may be redeemed for discounts on future purchases. You may also be granted rewards for being a member, such as for your birthday, and receive access to insider content or personalized experiences. 

Material Terms  

Consumers can view the Program’s full terms and conditions. The categories of personal information collected include:

• Identifiers (e.g., name, email address, password, physical address, phone number, date of birth and/or age).
• Personal information described in Subdivision (e) of Section 1798.80 (California customer records statute) (e.g., credit card number or other payment information).
• Commercial Information (e.g., products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies).
• Internet/Network Activity (e.g., browsing history or search history on the Chick-fil-A website or app).
• Geolocation Data (e.g., physical location or movements).
• Sensory Data (e.g., electronic, visual, or similar information).
• Inferences from personal information collected (e.g., customer profiles such as shopping preferences). 

How to Opt In to the Program 

Register for an account online at Chick-fil-A.com or on the Chick-fil-A App. 

Value of Consumer Data 

In our good faith calculation, we consider the value of consumer data collected through the Program as the equivalent of relevant expenses related to the collection and retention of consumers’ personal information as part of the Program.  The financial incentive we offer to consumers through the Program is reasonably related to the value of the consumer’s data. 

Withdrawal from the Program 

You have the right to withdraw from the Program at any time. Please note, withdrawing from the Program will result in the loss of earned points and unredeemed rewards, and will also limit your ability to utilize the full suite of features available in the Chick-fil-A One^® program.  You may withdraw by closing your Chick-fil-A One^® account via your profile within the Chick-fil-A app or website, or calling Chick-fil-A CARES (1-866-232-2040).  Please call Chick-fil-A CARES (1-866-232-2040) if you have a remaining balance on your Chick-fil-A One^® account or associated gift cards as you may not be able to close your account within the Chick-fil-A One^® program. 

Statistical Information

We publish metrics regarding the number of requests we have received, complied with (in whole or in part) or denied, and also the median number of days in which we responded to such requests, in the previous year, as applicable to the time period in which the CCPA was in effect.

The following details the metrics regarding consumer rights requests we received from all individuals, regardless of their state of residence, from January 1, 2021 to December 31, 2021.

Total Requests Received in 2021: 554

Request Type	Received	Granted (in whole or in part)	Denied	Median Days to Respond
Request to Know	36	27	9	Median:6.8
Request to Delete	518	363	155	Median:0.3

California Do Not Track

California Business & Professions Code Section 22575(b) (as amended effective January 1, 2014) provides that California residents are entitled to know how we respond to “Do Not Track” browser settings. We do not currently take actions to respond to Do Not Track signals because a uniform technological standard has not yet been developed. However, we respond to the GPC signals as the opt out preference signal as described in the “Cookies” Section above.

This California-specific addendum was last reviewed and updated as of January 1, 2023.