Arteaga's Food Center Privacy Policy

This Privacy Policy describes privacy practices associated with Arteaga's Food Center, the arteagas.com website, and Arteaga's stores and services. For convenience in this Privacy Policy, references to "Arteaga's," "we," "us," or "our" refer only to the business entity responsible for the particular Service or processing activity at issue. Those terms are used for ease of reading and do not mean that separately organized entities are a single business or enterprise, or that they are under common ownership or control.

This Privacy Policy applies when you visit arteagas.com or another website that links to this Privacy Policy; sign up for weekly advertisements, the Taco Club, or other marketing communications; request catering information or services; communicate with us; shop at Arteaga's stores; use services offered by Arteaga's or through an online platform; visit Arteaga's stores or facilities; interact with us through social media; or otherwise engage with Arteaga's products, services, promotions, or business operations (collectively, the "Services"). It describes online privacy practices and certain offline practices, including information collected at stores and facilities. It does not govern the independent privacy practices of third-party websites, applications, ordering platforms, payment processors, delivery providers, financial-service providers, employment-application platforms, or social-media platforms. Employment-related information is outside the scope of this consumer Privacy Policy and should be addressed through applicable applicant or employee privacy notices and the privacy practices of the relevant employment platform.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy and the practices described in it. If you do not agree with this Privacy Policy, please do not use the Services or provide personal information through them.

No amendment, modification, addition, deletion, or other change to this Privacy Policy proposed or made by a user will be effective unless expressly agreed to in writing by an authorized representative of Arteaga's.

Nothing in this Privacy Policy is intended to alter the separate legal status of any independently organized business entity that operates an Arteaga's location or service, or to establish that any such entity is the agent, alter ego, joint venture, partner, employer, or legal representative of another entity. References to Arteaga's, its stores, locations, or Services are used solely to describe privacy practices and consumer-facing services and are not a representation concerning corporate ownership, control, management, or legal relationships among separate entities.

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household. Personal information does not include information that is publicly available as defined by law, deidentified information, or aggregated information.

Personal information may be collected from the following categories of sources, depending on the particular Service or interaction: directly from you; automatically through your use of the Services; from Arteaga's stores and facilities, including security and surveillance systems; and from service providers, vendors, analytics providers, social-media platforms, business partners, and public sources.

Information You Provide Directly

• Contact information, such as your name, email address, telephone number, mailing address, and preferred store location.
• Catering and event information, such as event date, event location, delivery or pickup details, number of guests, menu selections, special instructions, and other information included in a catering inquiry or order.
• Marketing information, including your first name, last name, and email address when you join the Taco Club or subscribe to weekly advertisements. We also receive information about whether a marketing email was opened. Arteaga's currently uses Resend to manage these email communications.
• Customer-service, scheduling, and communications information, including information you provide when you request customer support, seek information about a purchase, return, exchange, or refund, schedule an appointment or meeting, or send us messages, inquiries, feedback, complaints, photographs, or other information by email, telephone, website form, social media, mail, or in person.
• Transaction and commercial information, such as records of products or services purchased, considered, returned, exchanged, or requested; store or transaction location; and information needed to process or address an order, return, exchange, refund, product concern, recall, or customer-service matter.
• Payment-related information when Arteaga's directly accepts payment for catering, merchandise, or other services. For catering requests submitted through the website, the website forwards the request to Arteaga's catering team, which follows up with the customer by telephone; the website does not currently process catering payments. Payment information provided by telephone may be processed through Arteaga's payment systems or third-party payment processors rather than stored by the website.
• Any other information you voluntarily provide to us.

Information Collected Automatically

• Device and network information, such as Internet Protocol address, browser type, operating system, device type, unique device identifiers, and general location derived from an IP address.
• Website activity, such as pages viewed, links selected, referring pages, dates and times of visits, time spent on pages, and interactions with website features.
• Cookies and similar technologies, including information collected through cookies, pixels, tags, local storage, and analytics technologies.
• Location information, when you permit your browser or device to provide location information to help identify nearby stores or provide directions.
• Interaction information generated when you open or interact with marketing emails, such as whether an email was opened. Arteaga's currently uses Resend to provide these email services.

Information Collected in Stores and Facilities

• Audio and video surveillance recordings from cameras and related systems located in or around applicable stores, parking areas, offices, and other facilities.
• Information concerning store incidents, safety events, suspected theft, loss-prevention matters, accidents, customer complaints, employee incidents, and related investigations.
• Transaction and customer-service information created during purchases, returns, exchanges, catering orders, or other store interactions.

Information from Other Sources

• Security and surveillance systems, including audio and video cameras, related monitoring equipment, and incident-reporting processes used in or around applicable stores and facilities.
• Service providers that support website hosting, Google Analytics, email communications through Resend, catering, payment processing, security, fraud prevention, and other business operations.
• Third-party services that you choose to use in connection with Arteaga's, to the extent those services provide information to Arteaga's outside the website and as permitted by law.
• Social-media platforms and public sources, depending on your settings and how you interact with our social-media pages.
• Business partners and other persons when permitted by law or at your direction.

The following table describes the categories of personal information Arteaga's may collect in connection with the Services and its business operations.

Sensitive Personal Information

The following table identifies categories of sensitive personal information recognized under California law that may be collected in limited circumstances. Audio recordings are sensory information and are not biometric information unless processed for the purpose of uniquely identifying a person.

We may use personal information for the following business and operational purposes:

• Provide, operate, maintain, and improve the Services, products, taquerias, catering services, and Arteaga's customer experiences.
• Respond to inquiries, comments, questions, customer-service requests, complaints, catering requests, product concerns, recalls, returns, exchanges, refund requests, appointment or meeting requests, and other communications.
• Send customer-service, support, operational, transactional, administrative, legal, security, and other non-marketing communications relating to your account, transactions, purchases, orders, catering requests, appointments, returns, exchanges, recalls, changes to our Services or policies, or other matters affecting your relationship with Arteaga's.
• Process, fulfill, and support transactions, orders, returns, refunds, catering services, and related communications.
• Send weekly advertisements, Taco Club emails, store information, promotions, coupons, event information, and other marketing communications, subject to your communication choices.
• Understand website use, improve website functionality, measure engagement, diagnose technical issues, and perform analytics.
• Personalize content and offers where permitted and consistent with your choices.
• Protect customers, employees, facilities, inventory, and property; deter and investigate theft, fraud, misconduct, safety events, accidents, workplace incidents, and other unlawful or inappropriate activity.
• Meet our obligations and enforce our rights arising from contracts, agreements, and transactions, including processing payments, billing, collections, refunds, chargebacks, and resolving payment disputes; establish, exercise, or defend legal claims; preserve evidence; comply with legal holds; and enforce our policies.
• Comply with applicable laws and regulations and respond to subpoenas, warrants, court orders, administrative or governmental orders, lawful requests from public authorities, tax requirements, reporting obligations, and other legal process.
• Work with outside professionals, including attorneys, accountants, auditors, insurers, consultants, and financial advisers, to obtain professional advice, conduct audits, manage insurance matters, comply with legal obligations, and establish, exercise, or defend legal claims.
• Conduct internal and external audits, verify compliance with Arteaga's policies and legal requirements, review transactions and business operations, and confirm the accuracy and effectiveness of our systems, records, advertising, and controls.
• Debug, identify, investigate, and repair errors or technical problems that impair the existing intended functionality, security, or performance of our website, systems, or Services.
• Evaluate or complete a merger, financing, acquisition, reorganization, sale of assets, bankruptcy, or similar business transaction.
• Carry out any other purpose disclosed to you when the information is collected or with your consent.

Except where applicable law requires otherwise, Arteaga's may use and process personal information for the business and commercial purposes described in this Privacy Policy without providing additional notice or obtaining additional consent. We may also use personal information for other purposes that are compatible with the context in which it was collected or that are otherwise permitted by applicable law.

We and our service providers may use cookies and similar technologies to operate the website, remember preferences, understand website traffic and performance, detect security issues, and improve the Services. Arteaga's currently uses Google Analytics to understand website traffic and performance. Embedded YouTube content may also place or access cookies when you interact with that content.

You may be able to control cookies through your browser settings. Blocking or deleting cookies may affect website functionality.

We may disclose personal information to the following categories of recipients for the purposes described in this Privacy Policy:

• Service providers and contractors, including website hosting, Google Analytics, email distribution through Resend, information technology, cybersecurity, payment processing, catering support, professional services, document storage, surveillance, fraud prevention, and customer-service providers.
• Third-party service platforms when necessary to provide a service you request or when you choose to interact with that platform in connection with Arteaga's, subject to the platform's own privacy practices.
• Financial-service and payment providers when you request a service they provide or when their services are needed to complete a transaction.
• Professional advisers, including attorneys, accountants, auditors, insurers, consultants, and financial advisers.
• Governmental authorities, law enforcement, courts, regulators, or other persons when disclosure is required or permitted by law or reasonably necessary to protect rights, safety, or property.
• Parties to a corporate transaction, including actual or prospective purchasers, investors, lenders, advisers, or successors in connection with a merger, financing, acquisition, restructuring, bankruptcy, or sale of assets.
• Other persons at your direction, with your consent, or as disclosed when the information is collected.

Sale and Sharing of Personal Information

Arteaga's does not sell personal information. We also do not knowingly sell or share the personal information of consumers under 16 years of age without the authorization required by applicable law.

California law defines "sale" and "sharing" broadly. Arteaga's uses Google Analytics for website analytics. Depending on the configuration and operation of analytics or other online technologies, certain disclosures may be treated as a sale or sharing under California law. To the extent applicable, California residents may exercise the rights described in Section 13 of this Privacy Policy.

The website contains links to services operated by third parties. Online grocery and prepared-food ordering links may direct you to Uber Eats, DoorDash, Grubhub, or Instacart. Orders placed through those services are submitted directly through the third party's platform or application. The Arteaga's website does not collect or process the information you submit when placing those orders. Employment links direct applicants to Paycom, which operates its own platform and privacy practices. The website may also link to mapping, social-media, payment, financial-service, and other third-party services.

Information that you provide directly to a third-party platform is governed by that platform's privacy policy. To the extent a third-party platform separately provides Arteaga's with information necessary to fulfill a service, address a customer-service matter, prevent fraud, or otherwise support an interaction with Arteaga's, this Privacy Policy applies to the information Arteaga's receives and controls.

Certain Arteaga's locations offer money-transfer and related financial services using systems operated by third-party providers. Money-transfer services offered through Western Union, including Vigo and Orlandi Valuta services, are processed through Western Union's systems. Personnel at the applicable location may receive or enter customer information in connection with a transaction, but the information is maintained in the provider's system rather than being stored separately by Arteaga's.

Certain Arteaga's locations also offer check-cashing services using third-party software. Information provided for check-cashing transactions may be received or entered by personnel at the applicable location through the provider's system and is stored by that provider. The business responsible for the transaction may access or use information associated with these services as reasonably necessary to complete the transaction, prevent fraud, comply with law, respond to legal process, resolve disputes, or address customer-service matters. Third-party financial-service and technology providers process information under their own legal obligations, agreements, and privacy practices.

Audio and video surveillance systems may be used in and around applicable stores and facilities. Surveillance may capture customers, visitors, employees, contractors, vehicles, activities, voices, and events occurring within range of the system.

We use surveillance and related incident information for safety and security; loss prevention; theft and fraud deterrence; investigation of accidents, complaints, suspected misconduct, employee incidents, and other events; protection of customers, employees, property, and inventory; compliance with law; cooperation with law enforcement; and the establishment, exercise, or defense of legal claims.

Access to surveillance recordings may be provided to personnel, service providers, professional advisers, law enforcement, or others with a legitimate business or legal need, subject to applicable law. Recordings may be retained for the period reasonably necessary for the purposes described above, subject to system capacity, incident preservation, legal holds, and legal requirements.

Personal information is retained for no longer than reasonably necessary for the purposes for which it was collected or processed, taking into account the nature of the information, the applicable business purpose, legal and accounting requirements, dispute resolution, safety and security, fraud prevention, and the establishment, exercise, or defense of legal claims.

In determining an appropriate retention period, we consider the amount, nature, and sensitivity of the information; the purposes for which we process it; whether those purposes can be achieved through other means; the potential risk of harm from unauthorized use or disclosure; our relationship with the individual; and applicable legal requirements. When retention is no longer reasonably necessary, we may delete, deidentify, or aggregate the information, subject to backup, archival, and legal-hold requirements.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, destruction, loss, misuse, alteration, or disclosure. However, no website, electronic transmission, storage system, or security measure is completely secure, and we cannot guarantee absolute security. You should use care when sending sensitive information by email, text message, social media, or other communications that may not be secure.

The website and Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information online from children under 13. If we learn that we collected personal information online from a child under 13 without legally sufficient authorization, we will take reasonable steps to delete it.

We do not knowingly sell or share the personal information of consumers under 16 without the affirmative authorization required by California law.

You may unsubscribe from marketing emails by selecting the unsubscribe link in an email or contacting us using the information below. Arteaga's does not currently use an SMS marketing provider or operate an automated SMS marketing program. Even after you opt out of marketing communications, we may continue to send non-promotional messages concerning transactions, requests, safety notices, product recalls, or our ongoing relationship with you.

This section supplements the other provisions of this Privacy Policy for California residents. To the extent the California Consumer Privacy Act, as amended (the "CCPA"), applies to the business entity responsible for a particular Service or processing activity, California residents may have the following rights, subject to applicable exceptions and verification requirements. Nothing in this section is intended to state or imply that separately organized entities constitute a single business for purposes of the CCPA or any other law.

Right to Know: Request the categories and specific pieces of personal information we collected about you; the categories of sources; our business or commercial purposes; and the categories of persons to whom we disclosed, sold, or shared personal information.

Right to Delete: Request deletion of personal information we collected from you, subject to legal and operational exceptions.

Right to Correct: Request correction of inaccurate personal information that we maintain about you.

Right to Data Portability: Receive eligible personal information in a portable and, where technically feasible, readily usable format.

Right to Opt Out of Sale or Sharing: Direct a business not to sell personal information or share it for cross-context behavioral advertising, including through an applicable opt-out preference signal.

Right to Limit Certain Uses of Sensitive Personal Information: Where applicable, limit the use or disclosure of sensitive personal information when it is used beyond purposes permitted by California law.

Right to Non-Discrimination: Receive equal service and pricing and not be retaliated against for exercising CCPA rights, subject to legally permitted differences and financial-incentive programs.

How to Exercise California Privacy Rights

To submit a request to know, access, delete, correct, or obtain a portable copy of personal information, contact us using one or more of the methods below:

• Email: Digital@Arteagas.com
• Website: https://arteagas.com/contact/

If the CCPA applies to the business responsible for the relevant processing activity, additional request methods will be provided to the extent required by applicable law.

Please describe your request with enough detail for us to understand and evaluate it. We may request information reasonably necessary to verify your identity and authority. Verification requirements may vary depending on the request and the nature and sensitivity of the information involved. We will use information provided for verification only for verification, fraud-prevention, and request-processing purposes.

You may authorize an agent to submit a request on your behalf. We may require proof that the agent is authorized and may require you to verify your identity directly, unless applicable law provides otherwise.

We will confirm receipt and respond within the time required by applicable law. We generally do not charge a fee unless a request is excessive, repetitive, or manifestly unfounded, as permitted by law.

Sale, Sharing, and Sensitive Information

Arteaga's does not sell personal information. To the extent the CCPA applies and Arteaga's engages in conduct that constitutes a sale or sharing under California law, California residents may exercise the applicable opt-out rights described above.

Where required by applicable law, the business entity responsible for the relevant collection of personal information will provide a notice at or before collection describing the categories of personal information collected, the purposes for which they are collected or used, whether they are sold or shared, and the retention period or criteria used to determine the retention period. The notice may be provided through the website, at forms or sign-up pages, in stores, through signage, or by another legally permitted method.

California "Shine the Light"

California Civil Code section 1798.83 may permit California residents to request information concerning certain disclosures of personal information to third parties for their own direct-marketing purposes. Arteaga's does not disclose personal information to third parties for their own direct marketing in a manner that requires reporting under this law. Requests may be directed to the contact information below.

Do Not Track

Some browsers offer a "Do Not Track" setting. Because there is no uniform industry standard for responding to Do Not Track signals, the website does not currently respond to those signals.

The Services may contain links to websites, applications, and services that Arteaga's does not own or control. We are not responsible for the privacy, security, or content practices of those third parties. We encourage you to review the privacy notices of any third-party service before providing personal information.

Arteaga's maintains policies, procedures, and safeguards designed to support compliance with this Privacy Policy and applicable privacy laws. We may investigate suspected violations of this Privacy Policy, our policies, or applicable law and take appropriate action, including restricting access to systems or Services, preserving relevant records, cooperating with governmental authorities or law enforcement, and pursuing available legal or equitable remedies.

Employees, contractors, service providers, and other persons who are authorized to access personal information are expected to handle it consistently with their contractual, legal, and policy obligations. Questions or concerns regarding Arteaga's privacy practices may be submitted using the contact information below.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or Services. We will post the updated Privacy Policy and revise the “Last Updated” date. If required by law, we will provide additional notice or obtain consent before materially changing how we use previously collected personal information. Your continued use of the Services after an updated Privacy Policy becomes effective constitutes your acknowledgment of the revised Privacy Policy, to the extent permitted by applicable law; it does not replace any consent that applicable law independently requires.

Questions, comments, accessibility requests, and privacy requests may be directed to:

Arteaga's Food Center, Attn: Privacy Requests | Email: Digital@Arteagas.com | Website: https://arteagas.com/contact/