California Consumer Privacy Notice

This notice applies to California residents and supplements our general Privacy Policy. It is provided pursuant to the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act of 2020 ("CPRA"). Terms used in this notice have the meanings given to them in those laws.

Personal information we collect

In the preceding 12 months, we have collected the following categories of personal information from California consumers. For each category, the examples below are not exhaustive.

Identifiers: name, email, phone number, postal address (when supplied), IP address, online identifiers from cookies and similar technologies.

Customer records (Cal. Civ. Code § 1798.80(e)): contact information submitted through our forms, such as catering and event requests.

Protected classification characteristics: limited employment-related information voluntarily supplied on job applications (for EEO compliance), where you choose to provide it.

Commercial information: order history processed through our ordering partners.

Internet or electronic network activity: browsing history on the Site, interaction with emails, and referring URLs.

Geolocation data: approximate location derived from IP address only (not precise GPS).

Professional or employment-related information: resumes, cover letters, and prior work history submitted through the careers forms.

Inferences drawn from the above to create a basic profile reflecting a consumer's preferences (for example, which location they tend to visit).

Sensitive personal information: we do not intentionally collect categories of sensitive personal information as defined by CPRA (such as Social Security numbers, precise geolocation, or racial or ethnic origin). If you include any such information voluntarily (for example, in a resume), we process it only for the purpose you supplied it.

Sources of personal information

• Directly from you (forms, email, phone calls, in-restaurant interactions).
• Automatically from your device or browser when you visit the Site.
• From service providers — for example, analytics platforms, form handlers, and ordering partners.
• From publicly available sources or social media platforms where you have interacted with us.

Business and commercial purposes for collection

• Performing the services you request (answering inquiries, processing catering and event bookings, fulfilling orders via our partners, reviewing job applications).
• Operating, maintaining, and securing the Site.
• Debugging and error resolution.
• Analytics and Site improvement.
• Marketing our own products and services to people who have expressed interest.
• Compliance with legal obligations and protection of rights, property, and safety.

Categories disclosed to third parties

In the preceding 12 months, we have disclosed the following categories to the following types of recipients for business purposes:

Identifiers and Internet activity — disclosed to our hosting, security, and analytics service providers (e.g., Vercel, Cloudflare, Google Analytics) for the purpose of operating and measuring the Site.

Commercial information — disclosed to our ordering partner (order.online) to fulfill orders you choose to place.

Professional or employment-related information — disclosed to our email provider (Google Workspace) so that we can receive and review job applications.

Identifiers and customer records — disclosed in response to legal process when we are required to do so.

Sale or sharing of personal information

We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.

We do not have actual knowledge of selling or sharing personal information of consumers under 16.

Retention

We retain each category of personal information only as long as necessary for the purpose it was collected and any lawful recordkeeping requirement. See the Data Retention section of our Privacy Policy for representative time frames.

Your California privacy rights

Subject to certain exceptions, California residents have the following rights:

Right to know — request that we disclose (1) the categories of personal information we have collected about you; (2) the categories of sources; (3) the business or commercial purposes; (4) the categories of third parties to whom we disclosed it; and (5) the specific pieces of personal information we have collected about you.

Right to delete — request that we delete personal information we have collected from you, subject to exceptions (for example, we may retain information needed to complete a transaction, detect security incidents, comply with a legal obligation, or exercise a legal right).

Right to correct — request that we correct inaccurate personal information we maintain about you.

Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of; we honor Global Privacy Control signals as a precaution.

Right to limit use of sensitive personal information — because we do not use sensitive personal information for purposes beyond those permitted by default, no additional limitation is necessary.

Right to data portability — receive the personal information you have provided to us in a readily usable format.

Right to non-discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercised your rights. We are permitted to offer financial incentives tied to personal information, but we do not currently do so.

How to submit a request

Email: info@elpueblomex.com with the subject "California Privacy Request" and describe the right you are exercising.

By mail: El Pueblo Mexican Food — Privacy, 820 Birmingham Drive, Cardiff, CA 92007.

You may also contact any El Pueblo location by phone and ask to be directed to the Privacy contact.

Verification

To protect your information, we must verify your identity before responding to most requests. Verification generally requires that you provide information we can match against what we already have — for example, the email address you used to submit a form, the approximate date of your interaction, or the contents of a specific message.

For deletion and correction requests, we may require a signed declaration under penalty of perjury.

We do not use your verification information for any purpose other than verifying your request.

Authorized agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide written proof of their authority (for example, a signed permission or a valid power of attorney). We may still contact you directly to verify your identity or to confirm the request.

Businesses that provide consumer-privacy-request services must be registered with the California Secretary of State where required by law.

Response timing

We confirm receipt of your request within 10 business days and will respond substantively within 45 calendar days of receipt. If we need more time (up to an additional 45 days), we will tell you the reason and the extension period in writing.

Appeals

If you are dissatisfied with our response, you may appeal by replying to our decision email within 30 days, or by writing to info@elpueblomex.com with "Privacy Appeal" in the subject line. We will respond to appeals within 45 days and, if we deny the appeal, will inform you of your right to contact the California Privacy Protection Agency or the California Attorney General's office.

Shine the Light

California Civil Code § 1798.83 allows California residents to request a notice disclosing categories of personal information we shared with third parties for their direct marketing in the preceding year. We do not share personal information for third-party direct marketing. To confirm, email info@elpueblomex.com with "Shine the Light" in the subject line.

Minors

We do not knowingly collect personal information from children under 13 and do not sell or share the personal information of consumers we know to be under 16. If you are under 18 and have posted content you want removed, contact us and we will remove it.

Global Privacy Control

We recognize the Global Privacy Control (GPC) browser signal. Although we do not sell or share personal information for cross-context behavioral advertising, a GPC signal is treated as a valid opt-out request to the fullest extent applicable.

Changes to this notice

We will update this California Consumer Privacy Notice as our practices change or the law evolves. Material updates will be flagged on the Site. The "Last updated" date above reflects the current version.

Contact

Email: info@elpueblomex.com (subject: "California Privacy")

Postal: 820 Birmingham Drive, Cardiff, CA 92007 (Attn: Privacy)