SPECIAL PRIVACY POLICY FOR CALIFORNIA RESIDENTS

This Special Privacy Policy for California Residents ("Privacy Policy") describes how information obtained from California consumers, including visitors to the www.carlsjrfranchising.com website and/or the Carl’s Jr. main website (www.carlsjr.com) (together or individually, "Website"), the Carl’s Jr. mobile application ("Application"), and Carl’s Jr. company-owned and franchised-locations, where applicable ("Locations") is collected, used, and disclosed by Carl’s Jr. Restaurants LLC and its parents, subsidiaries, franchisees and affiliates, and their respective stockholders, directors, officers, employees, agents, successors and assigns (collectively, "Carl’s Jr.," "we," "us," or "our"). This Policy also explains how you can exercise certain privacy rights. Please note that this Policy applies to information collected by Carl’s Jr. and/or independently owned and operated franchised locations, where applicable, and supplements the information contained in Carl’s Jr.’s Privacy Policy, available here. (follow this link for CKE's Privacy Policy).

For ease of reference, you may click on any of the following links to jump to one of the sections addressed below:

• California’s Shine the Light Law
• California’s Consumer Privacy Act

1. California Residents’ Rights Under the California Consumer Privacy Act
2. Categories of California Consumers’ Personal Information Collected
3. How Long We Keep Consumers’ Personal Information
4. How We Disclose, Share, and Sell Personal Information
5. Methods for Submitting CCPA Requests to Carl’s Jr.
6. Verification Process
7. Authorized Agents
8. Financial Incentive Offers
9. Contact Us for More Information

CALIFORNIA’S “SHINE THE LIGHT” LAW

Subject to certain limits under California Civil Code section 1798.83, California residents may ask Carl’s Jr. to provide them with (i) a list of certain categories of personal data that we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year, and (ii) the identity of those third parties. California residents may make one request per calendar year.

To make this request, you may contact Carl’s Jr. at the mail or email address listed in the “Contact Us for More Information” section below. In your request, please state that you are a California resident and provide a current California address for our response. Please allow up to thirty (30) days for a response. Carl’s Jr. reserves its right not to respond to such requests submitted to addresses other than those specified in the “Contact Us for More Information” section below.

CALIFORNIA’S CONSUMER PRIVACY ACT

1. California Residents’ Rights Under the California Consumer Privacy Act

   If you are a California resident, you have certain rights regarding information that is treated as Personal Information under the CCPA. Only you, or someone you legally authorize to act on your behalf, may make a request related to your Personal Information. We will only use the Personal Information provided in your request to process your request, including to verify your identity or that of your authorized agent. We cannot provide any Personal Information in response to a request if we cannot verify your or your authorized agent’s identity, or your authorized agent’s authority to make the request on your behalf, and/or if we cannot confirm that the collected Personal Information relates to you.

   See the “Methods for Submitting CCPA Requests to Carl’s Jr.” section below for information on how you can exercise your rights related to your Personal Information.

   • The right to know what categories of Personal Information are being collected, sold, shared, or disclosed and the categories of sources of that Personal Information.

   You have the right to know what categories of Personal Information we collect, sell, share, or disclose about you, our business or commercial purposes for collecting, selling, sharing, or disclosing Personal information, the categories of recipients to which we sell or share Personal Information, the categories of Personal Information that we disclosed for each category identified, the categories of recipients to which we disclosed that particular category of Personal Information, and the categories of sources of that Personal Information. These categories are described below in the “Categories of California Consumers’ Personal Information Collected” and “How We Disclose, Share, and Sell Personal Information” sections below.

   • The right to access collected Personal Information

   You have the right to request that we provide a copy of your Personal Information that we collected, sold, shared, or disclosed. You may submit a maximum of two requests in a 12-month period.

   See the “Methods for Submitting CCPA Requests to Carl’s Jr.” section below for information on how you can exercise your right to access collected Personal Information.

   • The right to correct inaccurate Personal Information

   If you believe that the Personal Information we maintain about you is inaccurate, you have the right that we correct that information.

   See the “Methods for Submitting CCPA Requests to Carl’s Jr.” section below for information on how you can exercise your right to corrected Personal Information.

   • The right to request deletion of Personal Information

   Subject to certain exceptions, you have the right to request that we delete Personal Information we have collected or maintained. Once we receive and verify your request, we will delete and instruct any applicable service providers to delete your Personal Information from our records, unless an exception applies.

   See the “Methods for Submitting CCPA Requests to Carl’s Jr.” section below for information on how you can exercise your right to delete collected Personal Information.

   • The right to opt-out of the sale and sharing of Personal Information

   CCPA provides you with the right to opt-out of the “sale” of your Personal Information, and to request that we do not share your Personal Information for cross-context behavioral advertising. To opt-out, please click here.

   • The rights of California consumers who are less than 16 years of age

   We do not sell or share the personal information of consumers who we actually know are less than 16 years of age (or any consumers).

   • The right to limit use and disclosure of Sensitive Personal Information

   You have the right to request us to limit the use and disclosure of your Sensitive Personal Information to uses/disclosures that are reasonably necessary to provide our goods and services, or as needed: to ensure security and integrity; to prevent fraud or illegal activity; for physical safety; for short-term, transient use, including for non-personalized advertising; to perform services on behalf of the business; and to verify or maintain the quality or safety of a service or device owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance such services or devices. We do not collect, sell or share a consumer’s Sensitive Personal Information for any purpose other than as reasonably necessary (described above).

   • The right to opt out of automated decision-making

   You have the right to opt out of automated decision-making, including profiling, that we use to evaluate certain personal aspects relating to your performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

   • The right to be free from discrimination

   You have the right to equal service, and we will not discriminate against you if you exercise your rights under the CCPA. However, under certain circumstances, we may offer you special discounts or other incentives for the right to continue to collect, use, or sell your Personal Information; please see “Financial Incentive Offers” described below.

2. Categories of California Consumers’ Personal Information Collected

   We collect a variety of categories of Personal Information about California consumers, their household, and/or their devices from both online and offline sources. We will not collect additional categories of Personal Information or use the Personal Information we collect for materially different, unrelated, or incompatible purposes without providing advance notice.

   Personal Information

   In particular, we have collected the types of Personal Information indicated in the chart below:

   Category	Examples	Purposes of Collection
   A. Identifiers	Name, alias, address, telephone email, unique personal identifier, account name, online identifier, IP address, or other similar identifiers	To process your requests and provide our products and services. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website and Application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website and/or Application, third-party sites, and via email or text message. To create and manage Customer Accounts and administer your participation in our programs, services and other offerings. To prevent fraud or to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. To protect the rights and interests of us and/or our independently owned and operated franchisees, such as to resolve any disputes, to enforce this Policy or any other policy, to protect the rights or property of others, or to prevent harm. To evaluate prospective franchisees of ours. As described to you when collecting your personal information.
   B. Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1797.80(e))	A name, address, telephone number, credit card number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories.	To process your requests and provide our products and services. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website and Application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website and/or Application, third-party sites, and via email or text message. To create and manage Customer Accounts and administer your participation in our programs, services and other offerings. Detecting, investigating, or protecting against malicious, deceptive, fraudulent or illegal activity. To respond to reviews, comments, or other feedback you provide us. To evaluate prospective franchisees of ours.
   C. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	To process your requests and provide our products and services. To personalize and develop our Website, Application, products, and services. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website and Application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website and/or Application, third-party sites, and via email or text message. To prevent fraud or to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. To protect the rights and interests of us and/or our independently owned and operated franchisees, such as to resolve any disputes, to enforce this Policy or any other policy, to protect the rights or property of others, or to prevent harm. To respond to reviews, comments, or other feedback you provide us. As described to you when collecting your personal information.
   D. Internet or similar network activity	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement	To process your requests and provide our products and services. To create and manage Customer Accounts and administer your participation in our programs, services and other offerings. For auditing, research, analysis and development, including to maintain and improve our Site, products, and services, and for other internal business purposes To personalize your Website and Application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website and/or Application, and third-party sites. To prevent fraud or to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. As described to you when collecting your personal information.
   E. Geolocation data	Physical location or movements	To facilitate locating the Carl’s Jr. location nearest to you. For auditing, research, analysis and development, including to maintain and improve our Website, Application, products, and services, and for other internal business purposes To personalize your Website and Application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website and/or Application, and third-party sites. Detecting, investigating, or protecting against malicious, deceptive, fraudulent or illegal activity. As described to you when collecting your personal information.
   F. Sensory data	Record phone calls and CCTV recordings	To provide you with support and to respond to your inquiries, including customer service to you. To process your requests and provide our products and services. To communicate with you. For auditing, research, analysis and development, including to maintain and improve our Site, products, and services, and for other internal business purposes. To prevent fraud or to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. To protect the rights and interests of us and/or our independently owned and operated franchisees, such as to resolve any disputes, to enforce this Policy or any other policy, to protect the rights or property of others, or to prevent harm. As described to you when collecting your personal information.

   
   

   We have obtained the Personal Information listed above from the following sources:

   • Directly from you. For example, from forms you complete on our Website or the purchase of products such as gift cards.
   • Indirectly from you. For example, through your interaction on our Website, our Application, or with our advertisers.

   Sensitive Personal Information

   In particular, we have collected the types of Sensitive Personal Information indicated in the chart below:

   Category of Sensitive Personal Information	Sources	Purposes for Collection
   Personal Information that reveals a consumer’s Social Security, driver’s license, state identification card, or passport number	Directly from you	To process your requests and provide our products and services. To prevent fraud or to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. To protect the rights and interests of us and/or our independently owned and operated franchisees, such as to resolve any disputes, to enforce this Policy or any other policy, to protect the rights or property of others, or to prevent harm. To evaluate prospective franchisees of ours. As described to you when collecting your personal information.
   Personal Information that reveals a consumer’s precise geolocation (location within a radius of 1,850 feet)	Indirectly from you	To facilitate locating the Carl’s Jr. location nearest to you. For marketing and advertising. For auditing, research, analysis and development, including to maintain and improve our Website, Application, products, and services, and for other internal business purposes. To personalize your Website and Application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website and/or Application, and third-party sites. Detecting, investigating, or protecting against malicious, deceptive, fraudulent or illegal activity. As described to you when collecting your personal information.

3. How Long We Keep Consumers’ Personal Information

   We keep the categories of Personal Information described above for as long as is necessary for the purposes described in this Privacy Policy or otherwise authorized by law. This generally means holding the information for as long as one of the following apply:

   • Your Personal Information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected the information;
   • Your Personal Information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the Personal Information was collected;
   • The Personal Information is reasonably required to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case); or
   • We are otherwise required or permitted to keep your Personal Information by applicable laws or regulations.

   Where Personal Information is used for more than one purpose, we will retain it until the purpose with the latest period expires. For more information about our retention policies, please contact us using the contact details below.

4. How We Disclose, Share, and Sell Personal Information

   We disclose Personal Information to our service providers and contractors for business or commercial purposes as described below. Although we do not sell Personal Information in exchange for money, some of our advertising practices may be classified as “sales” or “sharing” under California law. The second chart shows the categories of Personal Information we share for purposes of cross-context behavioral advertising or otherwise “sell,” as that term is defined under California law.

   Disclosures for a Business or Commercial Purpose

   We have disclosed following categories of Personal to the following categories of recipients:

   • Identifiers

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations.

   • Personal information categories listed in the California Customer Records statute

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations.

   • Protected classification characteristics under California or federal law

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Commercial information

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Internet or similar network activity

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Geolocation data (including precise geolocation data)

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Sensory data

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Professional or employment related information

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Non-public education information

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   • Inferences drawn from other personal information

     • Recipients may include: Our affiliates (including Hardee’s Restaurants LLC) and parent company and its and their respective franchisees and our service providers that support our business operations

   We disclose the categories of Personal Information to the recipients described above for the following business purposes:

   • Processing your purchases of or requests for products or services
   • Performing services (including processing, maintaining, or collecting Personal Information) on our behalf (e.g., processing payments, supporting our promotions, contests, gift cards or loyalty programs, and providing communications, technical, analytical, web hosting, cloud hosting and mobile application support, or other services on our behalf)
   • Auditing related to ad impressions
   • Ensuring security and integrity of Personal Information
   • Debugging to identify and repair errors that impair existing intended functionality
   • Short-term, transient use, including, but not limited to, non-personalized advertising
   • Providing advertising and marketing services (except for cross-context behavioral advertising)
   • Undertaking internal research for technological development and demonstration
   • Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us
   • Detecting or protecting against malicious, deceptive, fraudulent or illegal activity

   Sales and Sharing of Personal Information

   We may have sold or shared the following categories of Personal Information with the following categories of third parties:

   • Identifiers

     • Third parties may include Third-party advertising and analytics partners.

   • Personal information categories listed in the California Customer Records statute

     • Third parties may include Third-party advertising and analytics partners.

   • Commercial information

     • Third parties may include Third-party advertising and analytics partners.

   • Internet or similar network activity

     • Third parties may include Third-party advertising and analytics partners.

   • Inferences drawn from other personal information

     • Third parties may include Third-party advertising and analytics partners.

   We sell and/or share the categories of Personal Information to the third parties described above for the purpose of showing you relevant advertisement while you browse the Internet or use social media.

   We do not have any actual knowledge that we sell the personal information of consumers who are less than 16 years of age.

5. Methods for Submitting CCPA Requests to Carl’s Jr.

   You have the right to submit a verifiable request to us using the following methods:

   • ONLINE REQUEST FORM. You may submit a request to via our Consumer Portal located on our privacy page here.
   • TOLL-FREE TELEPHONE CALL. You may submit requests by calling our toll-free CCPA Request Hotline at 1-800-227-5757. A member of our team will acknowledge your request and guide you through the verification process within ten (10) days.

6. Verification Process

   Please note that, if you submit a request to know, request to delete, or request to correct, you will be asked to log into your account or to provide 2-3 pieces of Personal Information that we will match against our records to verify your identity. We may use the following information for verification purposes:

   Your first and last name Your e-mail address Your telephone number

   Depending on the request that you may, we may require you to provide a signed declaration affirming your identity (or your authorized agent’s identity, if applicable).

7. Authorized Agents

   An authorized agent is either a natural person or a business entity registered with the California Secretary of State that a consumer has authorized to act on his or her behalf.

   You may use an authorized agent to submit a request on your behalf. Your agent will need to provide: either (1) a power of attorney; or (2) your written permission to allow the authorized agent to submit the request on your behalf and verification of your identity.

8. Financial Incentive Offers

   You have the right to receive equal service and price and not be discriminated against if you exercise any of your CCPA rights. However, from time to time we may offer certain financial incentives, as permitted by the CCPA that can result in different prices, rates, or quality levels of our products and/or services. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

   Summary of Financial Incentives Offered.

   From time to time, Carl’s Jr. offers coupons, specials, and other discounts to consumers who have opted-in to receive marketing material from us by providing us with certain Personal Information. Consumers may also participate in our free loyalty/rewards program – the Carl’s Jr. My Rewards program (the “Program”). You will be enrolled in the Program only after you provide prior opt-in consent. Participation in the Program gives consumers the opportunity to accrue points to earn food items with qualifying purchases. The Program collects and retains members’ Personal Information in order to keep track of the points you have accrued and/or purchases you have made.

   Material Terms of Financial Incentives.

   When we offer a financial incentive or participation in our Program, the offer will include an explanation of the material terms of the incentive. The nature and value of any such offer or financial incentive may differ depending on what information we collect and use and whether you choose to enroll in the Program. Whether you consent to the financial incentive and/or to enroll in our Program and whether you choose to allow us to collect and use other types of Personal Information about you affects how we communicate with you and the types and frequency of offers that you may receive. Most financial incentives that we offer and the Program will involve one or more of the following categories of Personal Information:

   Name, email address, zip code, password, birthday, order history, purchase history, and physical address.

   How to Provide Opt-In Consent to Financial Incentive.

   Participation in our financial incentive and Program requires your prior opt-in consent. You can opt-in to participate in the financial incentives or Program by checking the box agreeing to the Program’s Terms and Conditions and our Privacy Policy when you sign up for the Program or otherwise indicate your consent when you request information from us.

   How to Revoke/Withdraw Consent to Financial Incentive.

   You make revoke your consent to any financial incentive (or opt-out) at any time by emailing us at [email protected].

   Please note that if you are a California consumer and submit a CCPA-related deletion request, we will ask you to confirm that you want to terminate your Program membership (and My Rewards account). If you choose to retain your Program membership, Carl’s Jr. will continue to use your personal information to provide the Program and related services or as otherwise permitted by applicable law.

   Value of California Consumers’ Personal Information.

   We do not assign a monetary value to the Personal Information that we collect and strive to only use that information to further our business in accordance with this Policy. To the extent that we are required to assign a monetary value to your Personal Information, it is equal to the value of the discount or financial incentive that we have provided to you.

9. Contact Us for More Information

   California consumers who have questions or concerns about our privacy policies and practices may contact a trained customer service representative through one of the following methods:

   • Toll-free call: 1-800-227-5757
   • Email: [email protected]

   Effective: January 1, 2023