Privacy Notice

Welcome and thank you for visiting. Picnic and its affiliates (which includes Restaurant Technology Solutions, LLC d/b/a Otter) (“we”, “our”, or “us”) provide this Privacy Notice to explain our privacy and information practices for our direct website food ordering platform (the “services”). This Privacy Notice describes the types of personal data we collect, how that personal data is used and disclosed, and your rights and choices regarding your personal data.

PERSONAL DATA WE COLLECT. “Personal data” is defined as any information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated with a particular individual. Personal data does not include anonymous, de-identified, or non-personal data. We collect the following types of personal data:
- Personal Data You Provide to Us. We collect personal data that you provide directly for a business or commercial purpose, such as when you access our website, enter into a contract, establish a user account with us, register for an event or our services, through social media outlets, in connection with a potential business relationship with us, or by giving us your contact information through making an online order. This personal data may include your name, email, phone number, and order information
- What We Get From Other Third Parties, Affiliates, and Subsidiaries. In certain circumstances, we collect personal data about you from certain third party partners, affiliates, and subsidiaries for a business and commercial purpose. We may combine this information with personal data provided by you. This helps us update, expand, and analyze our records, identify new customers, and create more tailored advertising to provide services that may be of interest to you. This personal data may include your contact information, social media information, commercial information, and inferences and preferences related to your behavior.
- What We Automatically Collect from You. We collect the following information for a business and commercial purpose from you when you use the services:
  - General System Information. Through your use of the services, we collect certain hardware and software information from you and your device such as your device id, device type, network information, time zone, operating system version, order printing information, device id location, IP address, and other general system information.
  - Cookies. We use strictly necessary cookies, web beacons, and similar technologies when you use our services. For example, these cookies include the ability to order menu items and check out. For more information, please visit our Cookies Notice.
USE OF PERSONAL DATA. Our primary purpose in collecting personal data is to facilitate and provide the services or information that you have selected to receive. Where required by law, we obtain your consent to use and process your personal data for these purposes. Otherwise, we rely on another authorized legal basis (including but not limited to the performance of a contract or legitimate interest) to collect and process your personal data. We use personal data for the following purposes:
- To Provide Your Requested Services. Our primary business and commercial purpose in collecting personal data is to facilitate and provide the services or information that you have selected to receive through either your consent or through entering a contract with us. For example, our core services relate to providing you with the items ordered through the services.
- To Manage User Registrations. If you have registered for an account with us, we process your personal data for a business purpose by managing your user account for the purpose of performing our contract with you according to applicable terms of service.
- To Contact You. With your consent or, in some cases for our legitimate interest, we use your personal data for our business and commercial purpose to contact you for marketing purposes, including telemarketing calls, and to send marketing emails that we believe may be of interest to you, such as product announcements, newsletters, informational materials, and details on upcoming events.
- To Manage Payments. If you have provided financial information to us, we process your personal data to verify that information and to collect payments to the extent that doing so is necessary for our business purpose to complete a transaction and perform our contract with you.
- To Plan, Manage, and Facilitate Special Events. With your consent, we use your personal data for our business and commercial purpose in event planning and management, including registration, billing, and connecting with other event attendees, or to contact you further about relevant products and services.
- For Security, Legal Obligations, and Investigations. We use your personal data for our business purpose and legitimate interest to prevent, detect, mitigate, and investigate potential security issues, as well as fraudulent or illegal activity. We may also use your personal data for a legitimate interest to comply with and enforce applicable legal requirements or to protect our interests or the interests of other third parties. This also includes sharing personal data with others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.
- For Improvements to Our Services and Products. We use your personal data for our business and commercial purpose and legitimate interest in connection with our products and services to diagnose technical problems, track and analyze usage, and make updates or improvements. For example, we may use your comments to improve or help guide future enhancements to our products and services.
SHARING OF PERSONAL DATA.
- Affiliates and Service Providers. We share personal data with our affiliates and like most businesses, we also share personal data with third-party service providers or vendors contracted to provide services on our behalf. Our service providers assist us by handling tasks such as IT services, data management, and order fulfillment.
- Advertisers. We may share personal data with our advertisers. Our advertisers may use your information to display advertisements to you through the services and advertisements for us on third party websites.
- Law Enforcement. We may share personal data with law enforcement agencies if we reasonably believe unlawful activities have occurred or the personal data may aid in an ongoing investigation. We may also share personal data with law enforcement agencies if we determine, in our sole judgment, that you have violated our agreements or policies or that the release of your personal data may protect the rights, property, interests, or safety of us, our affiliates or any other third party.
- Legal Processes. We may share personal data as required by, or permitted by, law, whether in response to subpoenas, court orders, other legal processes, or as we believe is necessary to exercise our legal rights, including defending against legal claims that have been or might be brought against us.
- Business Transfers. Your personal data may be transferred to a third party as a part of a potential sale, merger, reorganization or other similar transaction. In accordance with applicable laws, we will use reasonable efforts to notify you of any transfer of personal data to an unaffiliated third party.
- Consent. With your consent, we may disclose personal data about you to certain restaurant operators and other third parties. For example, at the checkout screen, you may select to provide your contact information to the store or restaurant fulfilling the order.
DATA PROTECTION RIGHTS.
- Individual Rights. Subject to applicable privacy laws, you may have certain legal rights over the personal data we hold about you. These rights may include the right to access and to obtain a copy of your personal data processed by us, the right to restrict (including any withdrawal or objection rights) the processing of your personal data, or the right to access, correct, delete your personal data. However, please note that such rights are not absolute. They do not always apply and exemptions may be applicable. In response to any such request, you may be asked to verify your identity and/or provide information that helps us to better understand your request. If we are unable to comply with your request, we will explain why.
- Exercise of Such Rights. Subject to applicable privacy laws, to exercise your individual rights, you may send an email to [email protected]. If you are not satisfied with how we process your personal data, please let us know and we will take reasonable steps to investigate your concern. If you are not satisfied with our response, you have the right to make a complaint to the data protection authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen.
DATA TRANSFER. Your personal data may be stored and processed in the United States and in any other country where we or our affiliates, subsidiaries, or third-party service providers maintain facilities or personnel. When you provide personal data to us, we may process and transfer your data within the United States and around the world. We follow applicable data protection laws when transferring personal data, including EU standard contractual clauses.
DATA RETENTION. We will retain your personal data for as long as legally permitted in light of the purpose(s) for which it was obtained and as outlined in this Privacy Notice. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the services to you; (ii) whether there is a legal obligation to which we are subject; or (iii) whether retention is advisable in light of our legal position.
SECURITY. We have technical and physical safeguards in place to help protect your personal data. However, no method of storage or transmission is 100% secure. We therefore urge you to exercise caution when conveying any personal data over the Internet. As when disclosing any information on the Internet, you should remain mindful that such information might be accessible by the public and, consequently, may be collected and used by others without your consent. You should also recognize that your use of the Internet and any other means of communication with us is solely at your own risk.
ADDITIONAL TERMS.
- This Privacy Notice does not apply to websites or applications offered by other organizations or individuals that may be displayed as content on our website, including point of sale systems or any delivery platforms. We encourage you to read the Privacy Notice of any third-party website or applications before transmitting personal data.
- The services are not directed to individuals under the age of 16 and we do not knowingly collect personal data from individuals under the age of 16.
- We reserve the right, at any time, to modify this Privacy Notice. You should review this Privacy Notice periodically so that you keep up to date on our most current policies and practices. We will note the effective date of the latest version of our Privacy Notice at the end of this Privacy Notice.
COMMUNICATIONS. If you have any additional questions or concerns about our Privacy Notice or any other privacy or security issue, please contact us at:

Attn: Legal & Compliance - Privacy Counsel
777 Figueroa St, Ste 4100
Los Angeles CA 90017
[email protected]

If we need, or are required, to contact you concerning any event that involves information about you, we may do so by email, telephone, mail, or as otherwise required by law.
US State Specific Disclosures
- State Specific Privacy Laws This section contains terms that reflect our commitment to comply with the California Consumer Privacy Act of 2018, as amended (the “CCPA”) and other US state privacy laws (together with the CCPA, “State Privacy Laws”). For the purposes of this section, “personal data” is defined as any information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated with a particular individual or household.
  - Information we collect, use, and disclose. We have collected the following categories of personal data from consumers within the last twelve (12) months:
    1. Identifiers – Such as the personal data you provide us and the personal data that we receive from third parties in the form of your name, business name, email, address, and telephone number.
    2. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) – Such as the personal data you provide us related to your signature, address, phone number, or other contact information.
    3. Commercial Information – Such as the personal data you provide us, the information we automatically collect from you, and information we receive from third parties. This personal data may be in the form of your contact information, cookies, and certain professional or social media information.
    4. Internet or Other Similar Network Activity – Such as the personal data we automatically collect in the form of cookies and general system information as well as other personal data collected from third parties including professional and social media information.
    5. Inferences – We may draw inferences through the personal data you provide us, the information we automatically collect from you, and the information we receive from third parties. These inferences may relate to your business profiles and other analytics.
    We have disclosed to service providers and to third parties for a business purpose items a to e. We have collected and used for a business purpose items a to e and items a to e for a commercial purpose. Please visit the Personal Data We Collect and Sharing of Personal Data sections of the Privacy Notice for more information on what personal data we collect and disclose. Please visit the section on Use of Personal Data for additional information on how we use personal data.
  - Your rights and choices. With exceptions, certain State Privacy Laws may provide you with specific rights regarding their personal data. This section describes the rights that you may have under applicable State Privacy Laws.
    1. Access to information and data portability rights. Certain State Privacy Laws provide consumers with the right to request a business disclose what personal data (and the categories) it collects, uses, discloses, and sells. Once we receive and confirm your verifiable consumer request, we will disclose to you the specific pieces of personal data we have collected from you. In that disclosure, you will also receive information that describes the following:
      - The categories of personal data that we have collected in the preceding 12 months
      - The categories of sources from which the personal data is collected
      - The categories of personal data that we have disclosed for a business purpose
      - The categories of third parties to whom the personal data was disclosed for a business purpose
      - The business or commercial purpose for collecting personal data
    2. Deletion request rights. Certain State Privacy Laws provide you with the right to request that we delete all of the personal data that we collected and retained from you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal data from our records, unless an exception applies.
    3. Data correction rights. Certain State Privacy Laws may have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.
    4. Exercising your rights. To exercise your rights, please visit the section above on Your Data Protection Rights. In order for us to honor your request, we must verify your identity. In your request, please provide us with your email address and name. We will then send you a verification email for you to respond to. Once verified, we will confirm receipt of the request within 10 days and provide information on how the business will process the request. We endeavor to respond to verifiable consumer requests within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. You may only make a verifiable consumer request for your personal data twice within a 12-month period. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We will select a format to provide your personal data that is readily usable. Please note that we cannot respond to your request or provide you with personal data if we cannot verify your identity or your authority to make the request and confirm the personal data that relates to you. Only you, or a person you authorized in writing or registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal data. You may also make a verifiable consumer request on behalf of your minor.
    5. Non-discrimination. We will not discriminate against you for exercising any of your CCPA rights.
  - Sale of personal data. We have not sold (as defined under the CCPA) any personal data of any consumers (including any consumers under 16 years old) to any third parties in the preceding 12 months. We do not “sell” personal data under the traditional sense of the word. However, we use advertising cookies with your consent.
- Shine the Light. Under California Civil Code sections 1798.83-1798.84, California residents who have an established business relationship with us are entitled to ask us for a notice describing what categories of personal data we share with third parties for their direct marketing purposes. This notice will identify the categories of information shared with third parties and will include a list of the third parties with which it is shared, along with their names and addresses. If you are a California resident and would like a copy of this notice, please submit a written request to us at the addresses listed below.
- Do not track. Some web browsers and devices permit you to broadcast a preference that you not be “tracked” online. At this time, we do not modify your experience based upon whether such a signal is broadcast.

Effective as of May 20, 2024

Last Revised May 20, 2024