PRIVACY POLICY
Last Updated: July 1, 2024

Introduction
Five Guys Enterprises LLC, along with its parent and affiliated entities (“Five Guys,” "us," or "we"), has adopted this Privacy
Policy to reflect our commitment to protecting your privacy and to inform you of our policies and practices regarding thecollection, use, and disclosure of any Personal Information we may collect. This Privacy Policy is incorporated in and part of
the Terms and Conditions for our Website. We take the collection of Personal Information from our consumers seriously andare committed to protecting your Personal Information in accordance with this Privacy Policy. Please read below to learn how
we collect, use, and disclose Personal Information.
Five Guys only seeks to collect Personal Information as necessary to provide the products and services that you request fromus and as otherwise disclosed in this Privacy Policy. Our Personal Information collection practices are focused so that we are
only collecting and using your Personal Information to provide value to you. This Privacy Policy has been prepared to give you
clear notice of:••••the categories of Personal Information collected and processed,
the purposes for that processing,whether we have shared or sold your Personal Information to any third parties, and,if you are a resident of a state or country that provides you with additional privacy rights, information about thoserights and how to exercise them.

For states and countries where you may have additional privacy rights, please see the corresponding portion of the section
titled “Your Privacy Rights and Choices.” Currently, that section applies only to residents of California, Colorado,
Connecticut, Nevada, Oregon, Utah, Virginia, Texas, the European Union, the additional countries that form the European
Economic Area (namely, Norway, Liechtenstein, and Iceland), and the United Kingdom. As additional privacy laws take effectfollowing the “Last Updated” date listed above, Five Guys will issue updates to this Privacy Policy and provide additional
information for residents of the applicable states to inform you about your rights and the methods you can use to exercise
those rights.
If you have any questions that aren’t answered in this Privacy Policy, you can always contact us at privacy@fiveguys.com or
by using the other contact information provided in the “Contact Us” section below.
IF YOU DO NOT AGREE TO THE TERMS OF THIS PRIVACY POLICY, INCLUDING THE TERM AND CONDITIONS FOR
OUR WEBSITE IN WHICH THIS PRIVACY POLICY IS INCORPORATED, YOU MUST NOTE USE THE WEBSITES AND
MUST NOT SUBMIT ANY INFORMATION THROUGH THE SERVICES. BY SUBMITTING INFORMATION THROUGH THE
SERVICES (AS DEFINED BELOW), INCLUDING ANY PERSONAL INFORMATION, YOU ACKNOWLEDGE AND AGREE
THAT WE MAY PROCESS YOUR PERSONAL INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY.

Where This Privacy Policy Applies
This Privacy Policy applies to: (a) our websites, including the website available at https://www.fiveguys.com/,
https://www.order.fiveguys.com/, https://careers.fiveguys.com/, https://restaurants.fiveguys.com/,
https://fiveguys.cashstar.com/, and other proprietary websites of Five Guys that may be used exclusively by our franchisees(e.g., the various https://bread.fiveguys.com websites) (each, a “Website” and collectively the “Websites”); (b) the Five Guys
mobile app (the “Mobile App”); (c) Five Guys’ business process applications that may be used exclusively by our franchisees;(d) our interactions with our consumers in our corporate-owned stores in Virginia, Colorado, Connecticut, Oregon, Texas, andCalifornia; (e) your participation in the Five Guys Text Messaging Program, if you opt-in; and, (f) sweepstakes, contests,
promotions, and, consumer satisfaction surveys (each, a “Service” and collectively the “Services”).
Please note that the franchisee-owned Five Guys stores are outside the control of Five Guys and, as such, this Privacy Policy
does not apply to your in-store interactions in those stores. We encourage you to contact those franchisee-owned Five Guys
stores directly to learn more about their privacy practices.
If a particular service provided by or on behalf of Five Guys refers to or links to a different privacy policy, then that privacy
policy applies. We encourage you to review the privacy policies and terms and conditions of use for all third-party services orlinks provided by or on behalf of Five Guys.

Contents of this Notice
SectionWhat can you find there?

The Types of Information
We Collect

This section describes the categories and examples of Personal Information that Five Guys
collects from you, as well as the categories of data subjects to which the collection practices
apply. We also describe information that does not constitute Personal Information that may becollected by Five Guys, including publicly available information, deidentified or aggregatedconsumer information, or information that is excluded from the scope of applicable privacy
laws.

Personal Information
Collected Via Technology

Our Websites and Services use automated collection technologies, such as cookies andinvisible pixels, to collect Personal Information from you. This section describes what
automated collection technologies are used, the purposes of that collection, and how you canmanage the use of automated collection technologies.

How We Use Your
Personal Information

Read this section to learn more about how Five Guys uses your Personal Information. Thissection also describes how you can opt-out of direct marketing emails, how we handle
automated decision making, and our practices with respect to deidentified information.

How We Share Your
Personal Information

This section describes Five Guys’ practices with respect to the sharing of your Personal
Information to third parties, including the categories of third-party recipients in connection withdisclosures for business purposes or sales of Personal Information. Read this section to learn
more about our Personal Information sharing practices for the prior 12 months.
We share Personal Information with our affiliates, service providers (including social media
websites, payment processors, ordering and delivery service providers, and website analytics
providers), contractors, and as otherwise described in this Privacy Policy in order to provide
you with products and services, when necessary for our service providers or contractors toprovide services to us, or for the other reasons listed in this section.

Sales of Personal
Information

The section describes Five Guys’ sales of Personal Information for the prior 12 months.
Some states interpret the sharing of personal information with third party service providers foronline advertising may be considered a “sale” of information. Except for this kind of sharing,
Five Guys does not sell your personal information and does not receive monetarycompensation or other financial benefits from any sharing we engage in.

Additional Legal Notices

We have created this section to provide you with additional notices about our privacy
practices, including notices about the security measures we take to protect your Personal
Information, how we handle Personal Information for children under the age of 16, links toother websites that might be available through our Websites, and how we notify you regarding
updates to our Privacy Policy.

Your Privacy Rights andChoicesThis section only applies to the residents of the states and countries that give additional
privacy rights. As of the date this Privacy Policy was posted, that includes California,
Colorado, Connecticut, Nevada, Oregon, Texas, Utah, Virginia, the European Union, theadditional countries that form the European Economic Area (namely, Norway, Liechtenstein,
and Iceland), and the United Kingdom. In this section, you can learn more about those privacy
rights and the options Five Guys has made available for you to exercise those rights.

Contact Us

If you would like to contact us with any questions regarding our Privacy Policy or privacy
practices, you can find our contact information here. If you live in a state or country that gives
you additional privacy rights, you can find out more information about exercising those rights
in the corresponding portion of the section titled “Your Privacy Rights and Choices.”

The Types of Information We Collect
We collect information that identifies, relates to, is reasonably capable of being associated with a particular living person orhousehold (“Personal Information”). Privacy laws around the world describe Personal Information using a number of different
terms, including personal data and personally identifiable information. For the purposes of this Privacy Policy, we use the termPersonal Information with the intention that it be interpreted to mean the same thing as these other terms. If there is a specific
type of Personal Information that has its own definition, we will provide that definition and use that name specifically (such as
Sensitive Personal Information).
Various privacy laws exclude certain types of information from the respective definitions of Personal Information. For yourawareness, Personal Information does not include:•••

Publicly available information from government records;
Deidentified or aggregated consumer information; or,Information excluded from the scope of applicable privacy laws (including the CCPA and GDPR), like:•health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;•
Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act(FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and theDriver’s Privacy Protection Act of 1994.

The privacy laws also refer to the individuals or households from which Personal Information is collected a number of ways,
including as data subjects or consumers. We use the term “consumer” in this Privacy Policy to avoid using unnecessarily
abstract terms, but that term, as we use it, is the same as a data subject and includes customers, job applicants, and ourbusiness-to-business contacts. Please note that if you are an employee of Five Guys, or their dependent or emergency
contact, a separate privacy policy applies to you and is available through Five Guys’ human resources information systems. If
you do not have access to those systems, please contact us for assistance by using the information in the “Contact Us”
section below.
We have chosen to disclose this information broadly so that all of Five Guys’ consumers are aware of our privacy practices,
however, subject to the law where you reside, only certain categories of consumers may be able to exercise the rights
described in the “Your Privacy Rights and Choices” section below.
The below chart contains a category of Personal Information labelled “Sensitive Personal Information.” Under the applicableprivacy laws, Sensitive Personal Information means Personal Information that reveals: (1) a consumer’s social security,
driver’s license, state identification card, or passport number; (2) a consumer’s account log-in, financial information, debit card,or credit card number in combination with any required security or access code, password, or credentials allowing access toan account; (3) a consumer’s precise geolocation (within a circle with a radius of 1,750 or less); (4) a consumer’s racial or
ethnic origin, religious of philosophical beliefs, or union membership; (5) the contents of a consumer’s mail, email, and text
messages unless the business is the intended recipient of the communication; or, (6) a consumer’s genetic data. Sensitive
Personal Information also include: (a) the processing of biometric information for the purpose of uniquely identifying a
consumer; (b) Personal Information collected and analyzed concerning a consumer’s health (mental or physical); and, (c)Personal Information collected and analyzed concerning a consumer’s sex life or sexual orientation. In Colorado, Connecticut,
Oregon, Texas, Utah, and Virginia, Sensitive Personal Information also includes Personal Information collected from a known
child younger than 13 years of age and information related to a consumer’s citizenship or immigration status.
Regardless of what state you live in that regulates the collection and use of Sensitive Personal Information, Five Guys does
not use the types of information listed in the “Sensitive Personal Information” definition, above, to develop inferences aboutyou.
In particular, in the prior 12 months we have collected the following categories of Personal Information from the listed
categories of consumers:
Category of
Personal
Information
Identifiers

ExamplesFirst and last name (or initials),postal address, Internet
Protocol (IP) address, email
address, phone number,account name, payment
information, Social Security
Number, or other similar
identifiers

Sources of Information

•
•

•
•

Directly from you
From third parties on
your behalf, such as
when they provide yourname and email to refer
you for a job
Indirectly from you, suchas through automatedcollection technologies
From service providers
or contractors, such associal media sites,
payment processors,ordering and delivery

Types of Consumers
Affected
•
•
•
•
•
•

Website users
Customers
Job applicantsFranchisees
Contractors (and theiremployees)
Service providers (andtheir employees)•Personal
Information under
California Civil Code
Section 1798.80(e)Name, signature, Social
Security Number, address,
telephone number, bankaccount name and number,other financial information,
insurance policy number,
health insurance information,and other information describedunder this law••

Note that some Personal
Information described in thiscategory overlaps with othercategories.
•

Protected
Classification
Characteristics

Commercial
Information

Age (40 years or older), race,color, ancestry, national origin,citizenship, religion or creed,marital status, medical
condition, physical or mental
disability, sex (including
gender, gender identity, gender
expression, pregnancy orchildbirth and related medical
conditions), sexual orientation,
veteran or military status,
genetic information (including
familial genetic information)••

Records of products or services
purchased or considered, orother purchasing history or
tendencies•••

Biometric

Genetic, physiological,
behavioral, and biologicalservice providers,advertising networks,
and analytics companies
or from the service
provider or contractor
when the consumer is an
employee or contractor
of a service provider
being engaged by Five
Guys
From publicly available
sources, such as publicrecords and social media
sites
Directly from you
From service providers
or contractors, such as
payment processors,ordering and delivery
service providers,advertising networks,
and analytics companies
or from the service
provider or contractor
when the consumer is an
employee or contractor
of a service provider
being engaged by Five
Guys
From publicly available
sources, such as publicrecords and social media
sites

•

Directly from you
From service providers
or contractors, such as
background checkcompanies or from theservice provider orcontractor when the
consumer is an
employee or contractor
of a service provider
being engaged by Five
Guys

•
•
•

Directly from you
Indirectly from you, suchas through automatedcollection technologies
From service providers
or contractors, such as
such as payment
processors, ordering anddelivery service
providers, advertising
networks, and analytics
companies

We do not collect this data

•
•
•
•
•

•

•
•

Website users (if you
provide this information
to us)
Customers (if you
provide this information
to us)
Job applicantsFranchisees
Contractors (and theiremployees)
Service providers (andtheir employees)

Job applicantsFranchisees
Contractors (and theiremployees)
Service providers (andtheir employees)

Customers
Franchisees

None.

Information

characteristics, or other activity
patterns used to extract atemplate or other identifier suchas fingerprints

from consumers.

Internet or Other
Similar Network
Activity

Browsing history, searchhistory, information on a
consumer’s interaction with theWebsites, Mobile App, Text
Message Marketing Program (ifyou subscribe), or
advertisements

•
•

•
•

Geolocation Data

Physical location or movements
Please also review the“Sensitive Personal
Information” row below. If you
use our Mobile App, we may
collect your precise geolocation
while you are using the Mobile
App if you consent to that use
based on your “Location”
settings for the app and yourdevice operating system.

•
•
•

•

Sensory Data

Audio, electronic, visual,thermal, olfactory, or similar
information including COVID-19
related temperature checks,
call monitoring, and video
surveillance••

Indirectly from you, suchas through automatedcollection technologies
From service providers
or contractors, such associal media sites,
advertising networks,
and analytics companies
Internet service providers
Mobile phone and text
messaging service
providers••••

Website users
Customers
Job applicantsFranchisees

Directly from you
Indirectly from you, suchas through automatedcollection technologies
From service providers
or contractors, such associal media sites,
advertising networks,
and analytics companies
or from the service
provider or contractor
when the consumer is an
employee or contractor
of a service provider
being engaged by Five
Guys (if permitted or
required by applicable
contract)
From publicly available
sources, such as publicrecords and social media
sites

•
•
•

Website users
Customers
Contractors (and theiremployees) if permitted
or required by applicable
contract
Service providers (andtheir employees) if
permitted or required byapplicable contract

Directly from you
From service providers
or contractors such as instore security/CCTV
providers

•
•
•

•

•
•

Professional or
Employment-RelatedInformation

Current or past job history or
performance evaluations•••

Directly from you
From service providers
or contractors, including
background checkproviders or from theservice provider orcontractor when the
consumer is an
employee or contractor
of a service provider
being engaged by Five
Guys
From publicly available
sources, such as social

•
•
•
•

Customers
Job applicantsFranchisees (if provided
to us)
Contractors (and theiremployees)
Service providers (andtheir employees)
Job applicantsFranchisees
Contractors (and theiremployees)
Service providers (andtheir employees)

media sites
Non-Public
Education
Information

Education records related to a
student maintained by aneducational institution or aparty action on its behalf, suchas grades, transcripts, classlists, schedules, financial
information, or disciplinary
records

We do not collect this datafrom consumers.

None.

Inferences

Profile information reflecting a
consumer’s preferences,characteristics, behavior,
attitudes, or other similar
information•

We generate thisinformation internally
From service providers orcontractors, such as
analytics companies orbackground checkproviders•••

Social Security Number,driver’s license, state
identification card, or passportnumber, racial or ethnic origin,union membership, information
related to a consumer’s
citizenship or immigration
status••Directly from you
From service providers
or contractors, such as
background checkproviders or from theservice provider orcontractor when the
consumer is an
employee or contractor
of a service provider
being engaged by Five
Guys•

Sensitive Personal
Information

If you use our Mobile App, we
may collect your precise
geolocation while you are using
the Mobile App if you consent
to that use based on your
“Location” settings for the app
and your device operating
system.

•

•

•
•
•
•

Job applicantsFranchisees
Contractors (and theiremployees)
Service providers (andtheir employees)

Mobile App users (withrespect to precise
geolocation if you opt-in
to that use)
Job applicantsFranchisees
Contractors (and theiremployees)
Service providers (andtheir employees)

We do not use thisinformation to draw
Inferences.

Please note that there are places on our Websites where a third party can provide your Personal Information (or you canprovide a third party’s Personal Information), such as the “Refer a Friend” feature on the https://www.joinfiveguys.com/. If you
provide a third party’s Personal Information through the use of these features, you are making a representation that you havethat third party’s permission to provide their Personal Information and that they have agreed to the terms of this Privacy Policy.
Where such features are made available, Five Guys will only use that information for the purpose for which it is given and does
not otherwise store or use that information.

Personal Information Collected Via Technology
When you visit the Five Guys Websites, including our web forms, we and our service providers acting on our behalf
automatically collect certain information using tracking technologies like cookies, web beacons, and similar technologies. We
use this information to understand how visitors to our websites use them and which pages and features of the websites aremost popular. This helps us understand how we can improve our websites and track performance of our advertisements andmarketing emails that are sent to you. In addition, we use tracking technologies to help improve the navigation experience on
the Websites.
A cookie is a piece of data contained in a very small text file that is stored in your browser or elsewhere on your hard drive.
Cookies allow us to identify your device as you navigate our websites or your account. This makes navigating and interactingwith our websites or your account more efficient, easy, and meaningful for you.
By themselves, cookies do not identify you specifically. Rather, they recognize your web browser. So, unless you identify
yourself specifically to Five Guys, such as by signing into your account, we do not know who you are just because you
visited our website. We use both session and persistent cookies. Session cookies are cookies that disappear from yourcomputer or browser when you turn off your computer. Persistent cookies stay on your computer even after you have turnedit off. Additionally, the cookies on our websites fall into five categories: (1) Strictly Necessary Cookies, (2) Functional
Cookies, (3) Performance Cookies, (4) Social Media Cookies, and (5) Targeting Cookies. To learn more about each categoryof cookie, you can visit our cookie consent tool by clicking on the “Cookie Preferences” link on cookie banner for the Website
you are visiting. If you have already selected your cookie preferences, you can clear cookies through your browser andrevisit the Website, which will cause the cookie banner to reappear. You can also manage your cookie preferences byclicking the green “Manage Allowed Cookies” button in the lower lefthand corner of our Websites.
In addition to cookies, Five Guys uses "pixels" to enable certain cookies or advertisements on the Websites and to track thenumber of times a link or advertisement is served on a webpage. A pixel is a tiny image that is loaded when you visit our
Websites or open our marketing emails, but instead of calling up an image, it causes a cookie or application to be
downloaded. Pixels can be used to track user activities, track the number of times a user has viewed a particular link oradvertisement, track and optimize website traffic, display advertisements, keep track of advertising commissions, andotherwise collect data for online marketing and website analysis. As with cookies, our Websites utilize both session pixels
and persistent pixels.
We also use cookies and tracking/marketing pixels for four general purposes: (1) to ensure the functionality, optimization,and ease of use of our Websites; (2) to ensure and maintain the security of our Websites; (3) to collect anonymous,
statistical data regarding how visitors interact with the Websites; and, (4) for marketing purposes. We also utilize the tools
available through Google Analytics in order to monitor site flow and statistical data regarding our Website users.
The cookies that we use for functionality and security purposes are considered Functional or Strictly Necessary cookies,
without which the Site would not function properly. These cookies allow some of the basic functions of our Websites to work
properly, such as remembering your preferences as you navigate the Websites. In addition, these cookies help us secure theWebsites by preventing cross-site request forgery attacks and by throttling excessive request rates.
We also use cookies to collect statistical information regarding how visitors interact with our Websites and to track repeat
visits to our Websites. While these cookies collect information regarding how you use our Websites in order to help us
understand site flow and improve our website, all such statistical data is anonymous and does not personally identify you.
These types of cookies are Performance Cookies.
Finally, we use both cookies and pixels on our Websites for marketing purposes, including: to check whether your browser
supports the use of cookies, to deliver general advertisements from third party advertisers, to present targeted
advertisements to particular Website visitors, to track the particular advertisements that have been displayed to you, tocollect data regarding how you interact with YouTube videos across different websites, to track your browser activity acrossdevices and marketing channels, to track the actions you take after viewing an advertisement in order to measure theefficacy of the advertisement, and to display particular advertisements in order to re-engage visitors that are likely to convert
to customers based on those visitors’ online behavior across websites. These types of cookies are either Social Media or
Targeting Cookies.
Depending on where you live, our Websites may place cookies on your devices after you have interacted with the cookie
banner made available on the Website you are visiting. In some regions, you will be required to opt-in to use of cookies by
our Websites, with the exception of Strictly Necessary Cookies, which are always in use and are required for our Websites tooperate. In other regions, you will have the option to opt out of the use of cookies by our Websites. Regardless of where you
reside, you have the option to manage the cookies we use in connection with the Websites through the cookie consent
settings and preferences centers made available to you on the Websites. If you have previously accepted cookies but wish tochange that preference, you will need to clear your browser’s cookies before revisiting the website and making a new
selection about the types of allowed cookies. Using the preference centers to manage cookies without clearing the saved
cookies through your browser settings will stop new cookies from downloading to your device in accordance with yourpreference election, but it will not delete any cookies that have previously been downloaded. You do need to make anaffirmative action to delete your cookies because they are downloaded to your browser or device and cookie banners do nothave the ability to perform those deletions on your behalf. If you want to accept more types of cookies, you can simply
interact with the cookie preference center without a need to clear the preexisting saved cookies.
In addition to using our preference centers, you can use your browser settings to opt out of most categories of cookies, withthe exception of Strictly Necessary Cookies. Some browsers allow a “do not track” (DNT) setting that requests that a web
application disable its tracking of an individual user. When you choose to turn on the DNT setting in your browser, yourbrowser will send a special signal to websites, analytics companies, ad networks, plug-in providers, and other web services
you encounter while browsing and stop tracking your activity. To set up DNT, you can visit the All About DNT page. If you dochoose to set up DNT, our cookie banner has been designed to automatically turn off all non-required cookies on Five Guys’
Websites for you. Please note that this may impact the functionality of our Websites or your account.
Several of the companies that utilize cookies or other tracking or monitoring mechanisms enable you to opt out of advertisingthrough mechanisms established by trade groups. To learn more about how to opt out of targeting and advertising cookies,
you can go to the Your Online Choices page, the Network Advertising Initiative page, and the Digital Advertising Alliance’s
Consumer Choice page. These opt-out tools are provided by third parties, not Five Guys. We do not control or operate thesetools or the choices that advertisers and others provide through these tools.

Global Privacy Control (GPC) is a technical specification that you can use to inform websites of your privacy preferences inregard to ad trackers. To set up GPC, you can visit the Global Privacy Control page. If you do choose to set up GPC, we willautomatically turn off all non-required cookies on Five Guys’ Websites for you. Please note that this may impact thefunctionality of our Websites.
For more information about third party cookies used on our Websites, please read the following:
Google Analytics
Our Websites use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses
“cookies,” which are text files placed on your computer, to help the Websites analyze how users use the site. The
information generated by the cookie about your use of the Websites (including your IP address) will be transmitted toand stored by Google on servers in the United States. Google will use this information for the purpose of evaluating youruse of the Websites, compiling reports on activity on our Websites, and providing other services relating to website
activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or
where such third parties process the information on Google’s behalf. Google will not associate your IP address with anyother data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser,
however, please note that if you do this you may not be able to use the full functionality of these Websites. By using our
Websites, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
To find out more information about how Google may use your information, we encourage you to visit:https://www.google.com/policies/privacy/partners/.
Facebook Pixel
Our Websites use the Facebook Pixel, a web analytics service provided by Meta Platforms Inc. (previously, Facebook
Inc.) (referred to, for convenience, as “Facebook”). The Facebook Pixel functions in the way described in the section
labelled “Personal Information Collected Via Technology” above. You may refuse the use of technologies like theFacebook Pixel by selecting the appropriate settings on your browser, however, please note that if you do this you may
not be able to use the full functionality of these Websites. By using our Websites, you consent to the processing of data
about you by Facebook in the manner and for the purposes set out above. To find out more information about how
Facebook may use your information, we encourage you to visit: https://www.facebook.com/business/m/privacy-and-data.
TikTok Pixel
Our Websites use the TikTok Pixel, a web analytics service provided by TikTok Inc. (“TikTok”). The TikTok Pixel
functions in the way described in the section labelled “Personal Information Collected Via Technology” above. You
may refuse the use of technologies like the TikTok Pixel by selecting the appropriate settings on your browser, however,please note that if you do this you may not be able to use the full functionality of these Websites. By using our Websites,
you consent to the processing of data about you by TikTok in the manner and for the purposes set out above. To find out
more information about how TikTok may use your information, we encourage you to visit:https://ads.tiktok.com/i18n/official/policy/business-products-terms and https://ads.tiktok.com/i18n/official/policy/privacy.

How We Use Your Personal Information
We may use or disclose the Personal Information we collect for one or more of the following purposes:
1.

2.
3.
4.
5.

6.
7.
8.

To fulfill or meet the reason you provided the information. For example, if you share your name and contact
information to ask a question about our products or services, we will use that Personal Information to respond to yourinquiry. If you provide your Personal Information to purchase a product or service, we will use that information toprocess your payment and facilitate delivery. If you provide Personal Information to enter a contest or sweepstake,we will use that information to process your entry and to contact you to fulfill the terms of that contest or sweepstake if
you win. We may also save your information to facilitate new product orders or process returns. If you provide
Personal Information to apply for a job with Five Guys, we will use that information to review and process yourapplication.
To provide, support, personalize, and develop our Services, products, and services.
To process your requests, purchases, transactions, and payments and prevent transactional fraud.
To provide you with support and to respond to your inquiries, including to investigate and address your concerns andmonitor and improve our responses.
To personalize your experience on our Services and to deliver content and product and service offerings relevant toyour interests, including targeted offers and ads through our Services, third-party sites, and via email or text message(with your consent, where required by law).
To provide you with Five Guys related information, promotions, offers, products, or services that you request from us
or that you have consented to receive via email direct marketing.
To help identify fraud and maintain the safety, security, and integrity of our Services, products and services,
databases and other technology assets, and business.
For testing, research, analysis, and product development, including to develop and improve our Services, products,

and services.
9. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
10. As described to you when collecting your Personal Information or as otherwise set forth in applicable privacy laws.
11. To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer ofsome or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, inwhich Personal Information held by us about our consumers is among the assets transferred.
We use your precise geolocation when you place an order through our Mobile App if you have configured the application
settings and your mobile device’s location settings to allow the use of precise geolocation. The precise geolocation data allows
the Mobile App to communicate with the store from which you placed your order so that we can ensure your order is hot andready when you arrive. If your settings do not allow the use of precise geolocation, the Mobile App will use an approximate
location that does not meet the definition of a precise geolocation. Regardless of your settings, your geolocation is only
collected from your Mobile App when you have placed an order, is only associated with the individual order placed, is only
collected while your Mobile App is open, and is only retained for a period of 30 days for the purpose of fulfilling support
inquiries. Following that 30-day retention period, precise geolocation data is purged or deidentified such that the data cannot
be used to identify you or your device. Use of precise geolocation is performed only on a strict opt-in basis, and you can
revoke your consent to that usage at any time by updating your Mobile App and device settings.
We will not collect additional categories of Personal Information or use the Personal Information we collected for materiallydifferent, unrelated, or incompatible purposes without providing you advance notice. We will not perform any automateddecision-making processes involving the information that we collect and, as such, do not engage in “profiling” as defined under
the applicable privacy laws, including the Colorado Privacy Act.
The following list describes in detail the purposes for which we and our services providers and contractors collect and use
each category of Personal Information. Each number below corresponds to the specific purpose listed above:
Category of Personal Information

Purposes for Collection and Use

Identifiers

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

Personal Information under California Civil
Code Section 1798.80(e)1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

Protected Classification Characteristics

1, 4, 9, 10, 11

Commercial Information

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

Biometric Information

We do not collect this data from consumers.

Internet or Other Similar Network Activity

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

Geolocation Data

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

Sensory Data

1, 4, 9, 10, 11

Professional or Employment-RelatedInformation

1, 4, 7, 9, 10, 11

Non-Public Education Information

We do not collect this data from consumers.

Inferences

1, 4, 7, 9, 10, 11

Sensitive Personal Information

1, 4, 7, 9, 10, 11

Five Guys may periodically engage in direct marketing as described above, however, you will be able to opt out at any time byfollowing the instructions included in every e-mail sent to you via the “Unsubscribe” link. You may not opt out of nonpromotional communications from Five Guys, including confirmation messages regarding successful order requests. Please
note, regardless of your communication settings, we may continue to communicate with you regarding changes to terms andconditions, Privacy Policy updates, data breaches, or other significant information related to your Personal Information for as
long as it is retained by Five Guys.
Consent to receive automated marketing text messages is not a condition of any purchase. If you have enrolled in the Five

Guys Text Messaging Program, you can opt-out at any time by replying STOP, END, CANCEL, UNSUBSCRIBE, or QUIT toany mobile message from Five Guys to opt out of the Program. You may receive an additional mobile message confirming
your decision to opt out. You understand and agree that the foregoing options are the only reasonable methods of opting out.
You acknowledge that Five Guys’ text message platform (the “Platform”) may not recognize and respond to unsubscribe
requests that alter, change, or modify the STOP, END, CANCEL, UNSUBSCRIBE or QUIT keyword commands, such as theuse of different spellings or the addition of other words or phrases to the command, and agree that Five Guys and its service
providers will have no liability for failing to honor such requests. You also understand and agree that any other method of
opting out, including, but not limited to, texting words other than those set forth above or verbally requesting one of Five Guys’
employees to remove you from Five Guys’ list, is not a reasonable means of opting out.
We may create Deidentified Information records from Personal Information by excluding information (such as your name
and/or IP address) that would allow someone to identify a specific individual. "Deidentified Information" means informationthat is not associated with or linked to your Personal Information, including any feedback you may provide, which cannot bereidentified with your Personal Information. Deidentified Information does not permit the identification of individual persons. We
may use this Deidentified Information to analyze request patterns and usage patterns so that we may enhance our products
and services. Five Guys reserves the right to use and disclose Deidentified Information to third parties in its discretion,
however, we will maintain and use the information in deidentified form and will not attempt to reidentify the information, or
authorize any third party to reidentify the information, except in connection with determining whether the deidentification
processes satisfy the requirements of applicable privacy laws.

How We Share Your Personal Information
We may disclose your Personal Information to a third party for a business purpose, specifically to enable and support the usesof your Personal Information described in the “How We Use Your Personal Information” section above. When we disclose
Personal Information for a business purpose, we enter into a contract that describes the purpose and requires the recipient toboth keep that Personal Information confidential and not use it for any purpose except performing the contract.
While Five Guys does not typically sell Personal Information, some states interpret the sharing of Personal Information withthird party service providers for online advertising may be considered a “sale” of information. For example, we allow third
parties, such as Facebook and Google, to place technologies (such as cookies) on our websites for purposes of marketing tousers of our websites. Except for this kind of sharing, Five Guys does not sell any of your information. In the interest of full
disclosure, we have indicated when your Personal Information may be considered a “sale” in certain states, such as California,
but want to assure you that most states do not consider this sharing a sale and otherwise we do not sell Personal Information.
For more details, please read the “Sales of Your Personal Information” section below.
In the prior 12 months, Five Guys has disclosed for a business purpose and/or sold Personal Information to the categories ofthird parties indicated in the chart below.

Category of Personal
Information
Identifiers

Category of Third-Party RecipientsBusiness Purpose
Sales
Disclosures
•

•
•
•

Personal Information under
California Civil Code
Section 1798.80(e)•Use for Targeted
AdvertisingService providers andcontractors, such as
payment processors,ordering and delivery
service providers,advertising networks,
analytics companies,
and background checkprovidersAffiliates of Five Guys
Franchisees of Five
Guys
Government agencies(subject to valid legal
processes)•

Service providers, suchas advertising networks
and analytics
companies•

Service providers, suchas payment
processors, orderingand delivery service
providers, advertising
networks and analytics
companies

Service providers andcontractors, payment
processors, orderingand delivery service
providers, advertising•Service providers, suchas advertising networks
and analytics
companies•

Service providers, suchas payment
processors, orderingand delivery service
providers, advertising•••Protected Classification
Characteristics

•

•
•
•

Commercial Information•••

networks, analytics
companies, andbackground checkprovidersAffiliates of Five Guys
Franchisees of Five
Guys
Government agencies(subject to valid legal
processes)

networks and analytics
companies

Service providers andcontractors (only ifsuch service provider isproviding services
relevant to thisinformation)
Affiliates of Five Guys
Franchisees of Five
Guys
Government agencies(subject to valid legal
processes or as
required by law)

We do not sell this data.

We do not disclose this data
for targeted advertising.

Service providers andcontractors, such as
payment processors,ordering and delivery
service providers,advertising networks,
and analytics
companies
Affiliates of Five Guys
Franchisees of Five
Guys

•

•

Service providers, suchas advertising networks
and analytics
companies

Service providers, suchas payment
processors, orderingand delivery service
providers, advertising
networks and analytics
companies

Biometric Information

We do not collect thisinformation fromconsumers.

We do not collect thisinformation fromconsumers.

We do not collect thisinformation from consumers

Internet or Other Similar
Network Activity•

Service providers andcontractors, such as
payment processors,ordering and delivery
service providers,advertising networks,
and analytics
companies
Affiliates of Five Guys••

Service providers, suchas payment
processors, orderingand delivery service
providers, advertising
networks and analytics
companies

We do not sell this data.

•

Service providers, suchas payment
processors, orderingand delivery service
providers, advertising
networks and analytics
companies•

Service providers andcontractors, such as
payment processors,ordering and delivery
service providers,advertising networks,
analytics companies,
and background checkprovidersAffiliates of Five Guys•

Service providers and

We do not sell this data.

We do not disclose this data•
Geolocation Data

Sensory Data•

Service providers, suchas advertising networks
and analytics
companies••Professional or
Employment-RelatedInformation•••

contractors, such as instore security/CCTV
providersAffiliates of Five Guys
Franchisees of Five
Guys
Service providers andcontractors, such as
background checkprovidersAffiliates of Five Guys
Franchisees of Five
Guys

for targeted advertising.

We do not sell this data.

We do not disclose this data
for targeted advertising.

Non-Public Education
Information

We do not collect thisinformation fromconsumers.

We do not collect thisinformation fromconsumers.

We do not collect thisinformation from consumers

Inferences••

Affiliates of Five Guys
Franchisees of Five
Guys

We do not sell this data.

We do not disclose this data
for targeted advertising.

Sensitive Personal
Information••

Affiliates of Five Guys
Franchisees of Five
Guys

We do not sell this data.

We do not disclose this data
for targeted advertising.

To our knowledge, any sharing of Personal Information does not knowingly involve information related to children under theage of 16.
We may share some or all of your Personal Information with "Affiliates" (parent company, subsidiaries, joint ventures, or othercompanies under common ownership and/or control), in which case we will require our Affiliates to provide at least the same
degree of protection for your Personal Information as we do under this Privacy Policy. If our company or our assets are
acquired by another company, that company will possess the Personal Information collected by us and it will assume the rights
and obligations regarding your Personal Information as described in this Privacy Policy.
If we disclose your Personal Information to Affiliates or third parties as identified in this section, we agree to be liable forviolations of your privacy rights by the Affiliates and third parties to which we have disclosed your Personal Information. Someof our Affiliates may be international organizations or organizations that were formed in the United States. If we share your
Personal Information with such Affiliates, we will use appropriate methods to transmit your information in accordance with allapplicable laws and regulations. Such methods may include the model contract clauses, binding corporate bylaws, or otherlegal transfer mechanisms that may take effect including the EU-US Data Privacy Framework.
Disclosures to Affiliates of Five Guys
We disclose your Personal Information to Affiliates of Five Guys as described above in the section labelled “How We UseYour Personal Information,” specifically:
•
•
•
•
•
•
•
•

To fulfill or meet the reason you provided the information.
To provide, support, personalize, and develop our Services, products, and services.
To process your requests, purchases, transactions, and payments and prevent transactional fraud.
To provide you with support and to respond to your inquiries, including to investigate and address your concerns andmonitor and improve our responses.
To personalize your experience on our Services and to deliver content and product and service offerings relevant toyour interests, including targeted offers and ads through our Services, third-party sites, and via email or text message(with your consent, where required by law).
To provide you with Five Guys-related information, promotions, offers, products, or services that you request from us
or that you have consented to receive via email direct marketing.
To help identify fraud and maintain the safety, security, and integrity of our Services, products and services,
databases and other technology assets, and business.
For testing, research, analysis, and product development, including to develop and improve our Services, products,•••and services.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
As described to you when collecting your Personal Information or as otherwise set forth in applicable privacy laws.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer ofsome or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, inwhich Personal Information held by us about our consumers is among the assets transferred.

Disclosures to Service Providers and Contractors
We will also disclose your Personal Information to service providers and contractors that help us run our business byprocessing Personal Information on behalf of Five Guys for the purposes identified in the section labelled “How We UseYour Personal Information.” Such companies include providers of customer support services (including those thatrecord or store communications), providers of analytics technologies that record and analyze your interaction with our
websites to help us improve your experience including payment processing services, fraud monitoring and prevention,
detecting and preventing deceptive or illegal activity or misuse of our Services, products, services, email, social media,
and other marketing platforms and service providers, and hosting services.
Disclosures to Government Agencies
We disclose your Personal Information to government agencies to respond to law enforcement requests and as requiredby applicable law, court order, or governmental regulations. We may also disclose your Personal Information to
government agencies as necessary if we have a good-faith belief that access, use, preservation or disclosure of theinformation is reasonably necessary to detect, prevent, or protect against such fraudulent, deceptive, or illegal activity,
misuse of our Services, products, or services, or security or technical issues, or where it is reasonably necessary toprotect from harm the rights, property or safety of Five Guys and our employees, our users, children, or the public asrequired or permitted by law.
In addition to the above, we may share your Personal Information with any third party at your instruction or request. That kindof sharing is not for our business purposes, though, and is not included in the above chart.
In certain circumstances, we may be required to disclose your Personal Information in response to lawful requests by publicauthorities, including to meet national security or law enforcement requirements, as well as to prevent crime or fraud.

Sales of Your Personal Information
Five Guys allows certain companies, who are service providers to Five Guys pursuant to written contracts, to place tracking
technologies like cookies and pixels on our sites, which allow those companies to receive information about your activity on
Five Guys’ Websites that is associated with your browser or device. The companies may use that data to serve you with more
relevant ads on our sites or others. Under some state laws, sharing data for online advertising like this may be considered a“sale” of information. Except for this kind of sharing, Five Guys does not sell any of your information.
To our knowledge, any sales of Personal Information do not knowingly involve information related to children under the age of
16.
You always have full control over whether these technologies work on your devices. You can disable them entirely using our
cookie consent preference tools (for instructions, see the section above labelled “Personal Information Collected Via
Technology”), or by clicking the “Your Privacy Choices” link on in the footer our websites.

Additional Legal Notices
How We Protect Your Information
To protect your Personal Information, Five Guys has adopted reasonable technical and organizational precautions inaddition to following industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed,
altered, or destroyed.
Five Guys has implemented industry-standard organizational and electronic means of protecting your Personal
Information. Our Websites make use of back-end technology that has been CSA STAR Certified and covered by a rangeof ISO certifications, including ISO 27001:2013, ISO 27017:2015, ISO 27018:2014, ISO 20000-1:2011, ISO 22301:2012,
and ISO 9001:2015, and which is designed protect your Personal Information. We store Personal Information behind acomputer firewall, which is a barrier designed to prevent outsiders from accessing our servers. In addition, Five Guys
protects your Personal Information from unauthorized physical access by storing your Personal Information in a controlled
facility. Except as provided elsewhere in this Privacy Policy, Five Guys limits access to Personal Information, regardlessof if it is stored electronically or in physical form, to those persons (including employees and contractors) in Five Guys'organization who have a business need for such access.

Even though we have taken significant steps to ensure that your Personal Information is not intercepted, accessed, used,or disclosed to or by unauthorized persons, you should know that Five Guys cannot completely eliminate security risks
associated with Personal Information.
The safety and security of your information also depends on you. If you choose, or are provided with, a user name,password, or any other piece of information when you create an account as part of our security procedures, you must
treat such information as confidential, and you must not disclose it to any other person or entity. You also acknowledge
that your account is personal to you and agree not to provide any other person with access to that account, or any portion
thereof, using your user name, password, or other security information. You agree to notify us immediately of any
unauthorized access to or use of your user name or password or any other breach of security. You also agree to ensurethat you exit from your account at the end of each session. You should use particular caution when accessing youraccount from a public or shared computer or device so that others are not able to view or record your password or other
Personal Information. You are entirely responsible for maintaining the confidentiality of the information you hold for youruser name, password, or other information related to your account. You may be held liable for losses incurred by us as aresult of your failing to keep your login information secure and confidential.
Data Retention
We will only keep your information, including any personal information, for as long as necessary to fulfill the purposes forwhich we collected it, to comply with our legal obligations, or to enforce our legal rights (or as required so others may
enforce their legal rights).
Generally, the length of time we keep your information will depend on the type of information and the purpose for which
we are processing it. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of
the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we are processing
it and whether we can achieve those purposes through other means, and any applicable legal requirements.
At the end of the appropriate retention period, we will either delete your information from our systems completely oranonymize it so it can be used without identifying you and so we no longer have the ability to re-associate theanonymized information with you in the future, such as by aggregating the information.
If you would like more information about our retention practices, please contact us using the information provided in the“Contact Us” section below.
Notice Regarding Children
We do not target our Websites or Services toward or intentionally gather Personal Information about visitors who areunder the age of 16. Furthermore, we do not intentionally allow visitors under the age of 18 to place orders via ourWebsites or Services. If a child under 16 submits Personal Information to us and we learn that the Personal Informationis the information of a child under 16, we will attempt to delete that Personal Information as soon as possible. If you
believe that we might have any Personal Information from a child under 16, please contact us using the information in
the below “Contact Us” section.
By using the Services, you represent that you are at least the age of majority in your state, province, or country ofresidence, or that you are the age of majority in your state, province, or country of residence and you have given us yourconsent to allow any of your minor dependents to use the Services.
Links To Other Sites
If we have provided a link to any other website or location, it is for your convenience and does not signify ourendorsement of such other website or location or its contents. We have no control over, do not review, and cannot be
responsible for these outside websites or their content. Please be aware that the terms of our Privacy Policy do not
apply to these outside websites.
Of particular note, please be aware that the Five Guys “Gear” website, available at https://shopfiveguys.com/ is operated
by our trusted partner, The Icebox - Cool Stuff, LLC, and is not controlled or operated by Five Guys. The terms of ourPrivacy Policy do not apply to that outside website, which has its own Terms of Service and Privacy Policy. We are notresponsible for the privacy practices of that website, except as otherwise required under the relevant laws andregulations. We encourage you to read their terms and privacy statements if you wish to utilize these websites andapplications.
Once you leave our Websites or are redirected to a third-party website or application, you are no longer governed by thisPrivacy Policy or our Websites’ Terms of Service. For your convenience, we may provide pop-up banners or notices insome instances when you leave our Websites or are directed to a third-party website or application, but we make norepresentations that we will provide such notice for all third-party links on our Websites.
When you click on links on our store, they may direct you away from our Websites. We are not responsible for theprivacy practices of other sites and encourage you to read their privacy statements.

Privacy Policy Updates
We reserve the right to amend this Privacy Policy at our discretion and at any time. If we change the way we collect,use, or disclosure your Personal Information that requires us to make changes to this Privacy Policy, we will post a
notice on this page and update the Privacy Policy’s effective date. Your continued use of our Services following any
posted updates to the Privacy Policy constitutes your acceptance of such changes. If you object to any of the changes to
our Privacy Policy, you must stop using the Services.

Your Privacy Rights and Choices
CALIFORNIA
As modified by the California Privacy Rights Act, the California Consumer Privacy Act ensures that California consumers
have the following rights with respect to the collection, use, sharing, sale, and other processing of their Personal
Information:

•

•
•
•
•
•
•
•

The right to know what Personal Information has been collected about you, including the categories of Personal
Information, the categories of sources from which the Personal Information is collected, the business or commercial
purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose
Personal Information, and the specific pieces of Personal Information we have collected about you;
The right to access the Personal Information, including to obtain a copy that can easily be sent to another data
controller;
The right to request the deletion of your Personal Information, subject to certain exceptions;
The right to correct inaccurate Personal Information;
The right to opt-out of the sale or sharing of your Personal Information;
The right to request the limitation of the use and disclosure of your Sensitive Personal Information;
The right to opt-in to sale or sharing of your Personal Information (if you have previously affirmatively opted-out); and,The right not to be discriminated against for exercising any of your rights with respect to your Personal Information.

To exercise any of these rights, please follow the link under “Exercising US Privacy Rights and Choices” and provide
the requested information.
We will not discriminate against you for exercising any of your California privacy rights. Unless permitted by applicablelaw, we will not:••••Deny you goods or services;
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or
imposing penalties;
Provide you a different level or quality of goods or services; or,Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods orservices.

Other California Privacy Rights
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Services that are California residents
to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing
purposes. To make such a request, please send an email to privacy@fiveguys.com or contact us using the information
provided in the “Contact Us” section.
COLORADO, CONNECTICUT, OREGON, TEXAS, UTAH, AND VIRGINIA
The privacy laws applicable to consumers who reside in Colorado, Connecticut, Texas, and Virginia ensure that
consumers have the following rights with respect to the collection, use, sharing, sale, and other processing of their
Personal Information:

•
•
•
•
•

The right to confirm whether a controller is processing Personal Information about the consumer and to access that
Personal Information, including to obtain a copy that can easily be sent to another data controller;
The right to correct inaccurate Personal Information;
The right to delete the Personal Information possessed by the controller;
The right to opt-out of the processing of Personal Information for the purposes of targeted advertising, sales of
Personal Information, or profiling in furtherance of decisions that product legal or similarly significant effects
concerning you as a consumer;
If your request is denied, the right to appeal that refusal; and,

•The right not to be discriminated against for exercising any of your rights with respect to your Personal Information.

The privacy laws applicable to consumers who reside in Oregon are similar to those of Colorado, Connecticut, Texas, andVirginia. The main difference with respect to the rights that Oregon’s privacy laws protect relates to how you can confirm
and access information about what Personal Information is being processed or has been processed about you. If you are
an Oregon resident, the privacy rights protected for you are:
•

•
•
•
•
•
•

The right to confirm whether a controller is processing or has processed Personal Information about you and to know
the categories of Personal Information the controller is processing or has processed, as well as the right to obtain alist of specific third parties (other than natural persons) to which the controller has disclosed your Personal
Information or any Personal Information;
The right to obtain a copy of your Personal Information that can easily be sent to another data controller;
The right to correct inaccurate Personal Information;
The right to delete the Personal Information possessed by the controller;
The right to opt-out of the processing of Personal Information for the purposes of targeted advertising, sales of
Personal Information, or profiling in furtherance of decisions that product legal or similarly significant effects
concerning you as a consumer;
If your request is denied, the right to appeal that refusal; and,The right not to be discriminated against for exercising any of your rights with respect to your Personal Information.

The privacy laws applicable to consumers who reside in Utah are also similar to those of Colorado, Connecticut, Texas,
and Virginia. The main difference in the rights that Utah’s privacy laws protect is with respect to the opt-out right.
Regardless, the privacy rights protected for Utah residents are:

•
•
•
•
•

The right to confirm whether a controller is processing Personal Information about the consumer and to access that
Personal Information, including to obtain a copy that can easily be sent to another data controller;
The right to correct inaccurate Personal Information;
The right to delete the Personal Information that you have provided to the controller;
The right to opt-out of the processing of Personal Information for the purposes of targeted advertising and/or sales of
Personal Information; and,The right not to be discriminated against for exercising any of your rights with respect to your Personal Information.

To exercise any of these rights, please follow the link under “Exercising US Privacy Rights and Choices” and provide
the requested information.
Appeals Process
If you are a resident of Colorado, Connecticut, Oregon, Texas, or Virginia and you believe that any request you havesubmitted has been denied in error, you are entitled to appeal that decision by submitting a request using the link under“Exercising US Privacy Rights and Choices” and provide the requested information. Utah does not offer a statutory
right to appeal, but please contact us if you have questions about any rights request that you believe was denied in error.
We strive to provide this information at the time of a denial but understand that you may have additional questions.
Specifically, you will need to provide your state of residence and contact information as required by the mandatory fields
within the webform, then should select that you would like to “Submit an Appeal” under the “Request Type” field. We will
also ask for your prior Request ID, which you can find in the subject line of the emails you have received from us withrespect to your prior request. You should provide your reason for requesting an appeal in the “Request Details” field of our
webform.
After receiving your appeal, members of our Privacy Team will review your appeal, the rationale for denying the initial
request, and will respond to you within 60 days regarding any action taken or not taken and the reasons for those actions.
If your appeal is denied, we will provide you with information by which you can contact the Virginia Attorney General inorder to submit a complaint.
NEVADAIf you are a resident of the State of Nevada, you have the right to request that Five Guys not sell the Personal Information
we currently have about you or that we might collect about you in the future. Although it is currently Five Guys’ policy not
to sell our consumers’ Personal Information as a “sale” is defined under Nevada law, if you would like to register an email
address with Five Guys to request that we not sell your Personal Information now or in the future, please follow the link
under “Exercising US Privacy Rights and Choices” and provide the requested information.

NON-DISCRIMINATION
We will not discriminate against you for exercising any of your privacy rights. Unless permitted by applicable law, we will not:

•
•
•
•

Deny you goods or services;
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or
imposing penalties;
Provide you a different level or quality of goods or services; or,Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods orservices.

EXERCISING US PRIVACY RIGHTS AND CHOICES
If you are a resident of California, Colorado, Connecticut, Virginia, or Nevada and would like to exercise any of the privacy
rights made available in the state where you are a resident, please submit a verifiable consumer request to us by either:••Calling us at (877) 258-2136;
Submitting your request using the below webform;
YOUR PRIVACY CHOICESOR,•

If you are a California resident, visiting one of our California corporate-owned Five Guys stores and submitting yourrights request on the physical forms available in store, which must be returned to Five Guys by mail in an envelope
affixed with the appropriate postage to the address listed on that form.

Please also note that you are currently only permitted to submit one type of request at a time on the above webform. If
you would like to submit multiple request types, please submit a separate form for each and we will work with you toprocess the requests in an appropriate order. For example, if you submit a deletion request and later submit a data
portability request, we may have already deleted your Personal Information from our systems and will be unable to fulfill
your data portability request.
Additionally, if you have an account on one of our Websites or the Mobile App, you may immediately access some of theinformation that we have collected about you by logging into your account on that Website or the Mobile App andnavigating to your user profile. Viewing your information through your account on our Website or Mobile App may notprovide you with all of the information to which you are entitled.
Only you, or where allowed by applicable law someone legally authorized to act on your behalf, may make a verifiableconsumer request related to your Personal Information. You may also make a verifiable consumer request on behalf ofyour minor child. If permitted by applicable law, to designate an authorized agent, you must authorize that agent to act on
your behalf and the authorized agent must provide a copy of that written authorization when submitting their request on
your behalf. For your information, authorized agents can be used by California residents to submit any rights request.
Authorized agents are permitted to be used by residents of Colorado, Connecticut, Oregon, and Texas for the purpose ofsubmitting a request to opt-out of the processing of your Personal Information as permitted in each state. We may contact
you or the authorized agent to ensure that you have given them the authority to act on your behalf.
The verifiable consumer request must:••

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected
Personal Information or an authorized representative, which may include:•Your first and last name;•
Email address(es);•Street address; and,Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Based on the information you have provided, we will make commercially reasonable efforts to verify your identity against
the information already in our systems. In the event we cannot verify your identity, we may request additional informationfrom you so that we may complete your request in compliance with the requirements of applicable law. Please note that if
you do not provide the required information, we may not be able to complete your rights request and will be required todeny it.
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority
to make the request and confirm the Personal Information relates to you.
You do not need to create an account with us to exercise the rights made available to you the applicable privacy laws. We
will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority tomake the request.

RIGHTS AND CHOICES FOR EU, EEA, AND UK CONSUMERS
If you are a resident of the European Economic Area or the United Kingdom, your local laws provide you with additionalrights regarding our use of your Personal Information. The following supplements the information contained in the othersections of this Privacy Policy and applies only with respect to Personal Information collected from residents of countries
to which the General Data Protection Regulation (“GDPR”) or UK General Data Protection Regulation (“UK-GDPR”)
apply.
Cross-Border Transfers
Five Guys is a corporation located in the United States. If Personal Information is collected on our behalf from residents ofthe European Economic Area or the United Kingdom, that information may be transferred to the United States, which is
not subject to an adequacy decision by the European Commission or the UK Information Commissioner’s Office. If
Personal Information is transferred to the United States, those transfers will be subject to legal transfer mechanisms that
may include the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer
Addendum to the European Commission’s Standard Contractual Clauses. Five Guys adopts additional measures toprotect your Personal Information during cross-border transfers including encryption in transit.
Lawful Bases for Processing
Under GDPR and UK-GDPR, the lawful bases we rely on for processing your Personal Information are:
•
•
•
•
•

You have given your consent to the processing of your Personal Information
Processing is necessary for the performance of a contract
Processing is necessary for compliance with a legal obligation
Processing is necessary in order to protect the vital interests of you or another person
Processing is necessary for the purposes of the legitimate interests pursued by Five Guys (provided that our interests
are not overridden by your interests or fundamental rights and freedoms)

Where you have given your consent to the processing of your Personal Information, you are able to revoke your consent
at any time and can do so by following the instructions in the section titled “Your Data Protection Rights” below.
Your Data Protection Rights
Under GDPR and UK-GDPR, you have the right to exercise control over your Personal Information, including:
•
•
•
•
•
•

Right of access – you have the right to obtain a copy of the Personal Information that we hold about you, including
other supplementary information
Right to rectification – you have the right to have inaccurate Personal Information corrected and to have incomplete
Personal Information completed
Right to erasure – you have the right to have the Personal Information that we currently hold about you erased,subject to certain exceptions (such as if the Personal Information is necessary for us to comply with a legal obligation)
Right to restrict processing – you have the right to request that we restrict the processing of your Personal
Information in certain circumstances
Right to object to processing – you have the right to object to the processing of your Personal Information incertain circumstances
Right to data portability – you have the right to obtain the Personal Information we currently hold about you in a
structured, commonly used and machine-readable format so that you can transmit that Personal Information directly
to another controller or you can request that we transmit that Personal Information for you

You are not required to pay any charge for exercising your rights under GDPR and UK-GDPR.
Exercising Your GDPR Rights
You have the right to control your Personal Information as described below. In order to request access to, correct, object
to our use and retention of your Personal Information, or to exercise any of your rights related to your Personal
Information as described in your local law, please send a request by e-mail to privacy@fiveguys.com or by mail using thecontact information listed in the “Contact Us” section below. Please include “Personal Information Request” in the subject
line of your e-mail.
You can control your Personal Information in the following ways:•••

You can ask us to see and/or obtain a copy of the Personal Information we hold about you;
You can inform us of any changes to your Personal Information, or if you want us to correct any of the Personal
Information we hold about you;In certain situations, you can ask us to erase, block, or restrict the Personal Information we hold about you, or object
to the particular ways in which we are using your Personal Information; and,•

In certain situations, you can also ask us to send the Personal Information you have given us to a third party.

When you contact us to exercise any of the privacy rights described above, please provide the following:
•
•
•
•
•

Your first and last name;Your e-mail address;
Your phone number;Your country or countries of citizenship; and,A brief description of your request, which can be based on the above list.

Because we do not want your Personal Information to be exposed to someone else, we will make a reasonable effort toconfirm your identity before processing your request. This identity confirmation effort may come directly from us or from atrusted vendor.
Five Guys will only use the Personal Information you provide in connection with your request to check our systems andconfirm whether we possess any of your Personal Information and to process any Personal Information access or
management requests we receive from you. After we have completed reviewing your request, we may store theinformation we provide to you for a reasonable amount of time after fulfilling your request in case you have additional
inquiries. After the information is no longer necessary, we will automatically delete this information from our records ormake it permanently unreadable (masked data).
Any contact information provided in connection with a request to exercise your rights related to your Personal Information
will not be used for direct marketing purposes and will not be shared with others unless necessary to verify your identity
and/or complete your request.
Response Timing and Format
We will do our best to respond to your request as soon as possible, and, in any event, no later than 30 days after
receiving your request. Please note that making multiple requests at one time may slow down our processing of yourrequest. If additional time is required to complete your request, we will notify you of that fact and the reasons why werequire additional time to fully respond to your particular request.
In certain circumstances, where we are able to do so, some requests may need to be fulfilled in a logical order. For
example, if you request to see what information Five Guys has about you and at the same time request that Five Guyserase your Personal Information, we will first provide you with access to your Personal Information, then we may ask you
to confirm again that you would like us to delete that information.
In some circumstances, we may not be able to comply with your requests related to your Personal Information. In thosecases, we will respond as soon as possible, and, in any event, no later than 30 days after receiving your request. Our
response will let you know if and why we are not able to comply and will share information with you about how you canobject to the relevant Supervisory Authorities if you think our continued use or maintenance of that information is
improper.
How to Complain
If you have any concerns about our use of your personal information, you can make a complaint to use using theinformation contained in the “Contact Us” section below. We request please contact us first so we can try to resolve yourconcerns. We are committed to working with you to obtain a fair resolution to any complaint or concern you may haveabout our use of your Personal Information.
If, however, you believe that we have not been able to assist with your request, complaint, or concern, you may have theright to lodge a complaint with the data protection authority in your country (if one exists in your country) or supervisory
authority. You can find more information about your data protection authority, including their contact information, by
following this link to the European Data Protection Board’s website: https://edpb.europa.eu/about-edpb/aboutedpb/members_en. You may also have a right to a judicial remedy if it is determined your Personal Information is being
used illegally.
If you are a UK resident, the data protection authority is the Information Commissioner’s Office (“ICO”), which can becontacted using the below information:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
CheshireSK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

Contact Us
If you have any general questions about our Privacy Policy or questions about how we collect, use, or share your Personal
Information, or would like to exercise your rights with respect to your Personal Information as permitted by certain laws
applicable to consumers as described in greater detail below, please do not hesitate to contact our Privacy Officer at:
Phone: (877) 258-2136
Privacy Policy Location: https://www.fiveguys.com/Privacy-Policy
Email: privacy@fiveguys.com
Mailing Address:
Five Guys Enterprises LLC
ATTN: Privacy Officer
1940 Duke Street
5th Floor
Alexandria, VA 22314 USA