PRIVACY POLICY


Last Updated: October 1, 2024

This Privacy Policy describes how Hot Topic, Inc. and its affiliates, BoxLunch and Her Universe, (collectively, “Hot Topic Brands”, “we”, “us”, or “our”) process personal information about you. This Privacy Policy applies when you:

  • Visit or interact with a Hot Topic Brands website (“Sites”);
  • Use a Hot Topic Brands mobile application (“Apps”);
  • Interact with us online, such as through our social media (“Online Interactions”); or
  • Interact with us offline, such as in our physical retail stores, by telephone, or at in-person events (“Offline Events”).

  • The Sites, Apps, Online Interactions, and Offline Events are collectively referred to as the “Services.”

    Please read this Privacy Policy carefully as it explains how Hot Topic Brands may use and disclose such information, as well as your ability to control certain uses of it. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY POLICY, THEN PLEASE DO NOT USE THE SERVICES.

    By using the Services, you are agreeing to (i) the collection, use, and disclosure of your information as described in this Privacy Policy, and (ii) to our Terms of Use, which are incorporated by reference. If you do not agree to these terms, stop accessing or using the Services and see information below about your rights.

    HOT TOPIC BRANDS AND ALL ASSOCIATED SERVICES AND SYSTEMS ARE DIRECTED TO RESIDENTS OF THE UNITED STATES AND HOUSED ON SERVERS IN THE UNITED STATES. IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, INFORMATION WE COLLECT (INCLUDING COOKIES) IS PROCESSED AND STORED IN THE UNITED STATES, WHICH MAY NOT OFFER THE SAME LEVEL OF PRIVACY PROTECTION AS THE COUNTRY WHERE YOU RESIDE OR ARE A CITIZEN. BY USING THE SERVICES AND PROVIDING INFORMATION TO US, YOU CONSENT TO THE TRANSFER TO AND PROCESSING OF YOUR INFORMATION IN THE UNITED STATES.


    CONTENTS

    I. WHAT INFORMATION DO WE COLLECT?

    II. WHERE DO WE COLLECT INFORMATION FROM?

    III. HOW DO WE USE THE INFORMATION WE COLLECT?

    IV. WHEN DO WE SHARE INFORMATION?

    V. COOKIES

    VI. YOUR CHOICES AND OPT-OUTS

    VII. YOUR CALIFORNIA PRIVACY RIGHTS/NOTICE AT COLLECTION

    VIII. NEVADA PRIVACY RIGHTS

    IX. COLORADO, CONNECTICUT, MONTANA, OREGON, TEXAS, AND VIRGINIA PRIVACY RIGHTS

    X. UTAH PRIVACY RIGHTS

    XI. THIRD-PARTY CONTENT, LINKS, AND PLUG-INS

    XII. PUBLIC FORUMS

    XIII. CHILDREN’S PRIVACY

    XIV. DATA STORAGE, RETENTION, AND SECURITY

    XV. CHANGES TO THIS PRIVACY POLICY

    XVI. HOW TO CONTACT US


    I. WHAT INFORMATION DO WE COLLECT?

    We collect:

  • Personal identifiers, such as your name, date of birth, gender, phone number, email address, and postal address. If you have created or enrolled in one of our loyalty programs, we also collect your account number, username and password, and similar data.

  • Financial and commercial information, such as your payment card number, billing address, expiration date, and related financial information. We also collect transaction information such as purchasing history.

  • Audio, electronic, and visual information, such as photos and other information you post on our Sites or Apps. This also includes information you provide from your social networking sites, such as social media account ID, profile photo, and other data made available when you choose to link your social media accounts or loyalty accounts. We also collect communications between you and any Hot Topic Brands.

  • Communications between you and any Hot Topic Brands (whether in written, audio, or video format), including, but not limited to, questions or comments submitted by you to our customer service departments (through phone, email, live chat, automated chat, or otherwise), as part of an interactive event or feature, or in connection with product reviews (including any photographs you submit as part of a product review).

  • Internet and other electronic network activity information, such as how you use our Sites or Apps, the products you have viewed, and what website you visit when you leave. We also collect information through Cookies and similar technologies that may capture your internet protocol (IP) address, personal device identifiers, the type of browser you are using, your operating system, ISP information, and similar online identifiers. See Section V below on Cookies for more information about how we collect information about your online activity.

  • Geolocation information from your IP address, which links to the region from which you are accessing the Sites or Apps.

  • Inferences. We may use information from the categories of personal information described above in order to create a profile about you, to reflect your preferences, characters, behavior and attitude.

  • The information described above shall be collectively referred to as “Personal Information.”


    II. WHERE DO WE COLLECT INFORMATION FROM?

    We collect your Personal Information from the following sources:

  • You, when you buy something; register or create an account; enroll in one of our loyalty programs; maintain a Wish List; request information from us; sign up for our newsletters, email list, or text message list; participate in a contest, sweepstakes, or other promotion; fill out a survey; submit a product review; connect with us on social media; request or contact customer service; communicate with or contact us through any means (for example, phone, email, text message, live chat, automated chat, or app); or otherwise use the Services.

  • Cookies and similar website interaction technologies, when you use our Sites or Apps.

  • Third-party analytics scripts, which facilitate features on our Sites or Apps, including, but not limited to, video and streaming functionality, social features such as embedding links to our social media, session replay technology which reconstructs a user’s experience to help us improve website functionality, customer support solutions such as live and automated chat features, developer utilities like site monitoring and fraud detection, and other similar services.

  • Social media platforms, when you interact with us on social media. For example, the Services may give you the option to link to your Facebook or other social media account, follow us, or share content on our account, your account, or your friends’ account. Based on the way you have set your privacy settings on your social media accounts, most social media platforms, like Facebook, analyze data about how you interact with our Services and combine it with information on other users to provide us information about your name, profile name, demographic information, contact information, region, interests, and usage data. In addition, we may receive information about you if other users interact with us on social media and information about you is visible to us, for example the fact that you are “friends” or other public-facing profile information.

  • From third parties, including our vendors and service providers.

  • From security devices, such as security cameras when you visit our stores. We collect audio, electronic, and visual information.

  • Business partners, if they either have your consent or another legal basis to share your information with us. If you provide your Personal Information to other businesses, we do not control how they treat your information and are not responsible for their conduct. Instead, you should look to those businesses’ policies and notices to understand how they treat your information and how to exercise your rights.

  • III. HOW DO WE USE THE INFORMATION WE COLLECT?

    We use your Personal Information for the below purposes:

  • For transactional purposes. Transact business with you, including to (i) provide products, information, or services that you have requested or agreed to receive, such as processing and delivering your orders; (ii) communicate with you; (iii) provide you with customer assistance; (iv) process payments; and (v) provide supporting business activities such as billing and collections, procurement, and tax related activities.

  • For Sites and Apps functionality. Enable you to: (i) participate in a variety of features on our Sites or Apps, such as sweepstakes, message boards, customer support, other communication features like live and automated chat, user-generated content functions, and interactive features; and (ii) invite friends to use our Services, for example when you send someone else a communication through the Services, like an invitation to a friend, we use the information you provide (e.g., your friend’s name and e-mail address) to send the invite.

  • For analytical purposes. Analyze preferences, trends, and statistics.

  • For our loyalty programs. Process your registration and/or enrollment in any loyalty programs, including by verifying that your email address is active and valid.

  • For marketing and promotional purposes. Improve our marketing efforts, conduct market research, provide you with information about us including personalized marketing communications, and contact you with information, newsletters, and promotional materials from Hot Topic Brands or on behalf of our third-party partners and affiliates.

  • For maintenance and improvement of our Sites, Apps, and systems. Improve our Sites, Apps and systems; provide and maintain functionality on our Sites, Apps and systems; and help us diagnose technical and service problems and administer our Sites, Apps, and systems.

  • To develop and improve our products and services. Analyze and understand how you use and interact with our Services to develop new products or services, or enhance or improve our existing content, products, and services.

  • For security and fraud prevention. Conduct vendor due diligence and protect our Sites, Apps, premises, networks, assets, systems, products, Services, and intellectual property from fraud, theft, and other misconduct.

  • For legal purposes. Comply with our legal obligations, including reporting requirements; defend ourselves in legal proceedings; and protect our company and our property, employees, and others through legal proceedings.

  • For other purposes. For other reasons we may describe to you.

  • Payment Processing. We use third party payment processors to assist with securely processing your payment information. If you pay with a credit card or other form of electronic payment, the payment information that you provide through the Services is encrypted and transmitted directly to the payment processor. We do not store your payment information and do not control and are not responsible for the payment processor or its collection or use of your information. You may find out more about how payment processors store and use your payment information by accessing the privacy policy for the payment processor’s services.

    BoxLunch Brand Ambassador Program. If you participate in BoxLunch’s “BL Collective” brand ambassador program (an overview of which can be found here: https://www.boxlunch.com/boxlunch-collective/), in addition to the information set forth in Section I, we may also collect Protected Classification Characteristics. These Protected Classification Characteristics include age, race, ethnicity, sex (including gender, gender identity, and gender expression), or sexual orientation. Hot Topic Brands uses this information to maintain a diverse group of program ambassadors.

    If you are invited to join the ambassador program, you will be required to create a profile on our third-party influencer management platform, CreatorIQ. We do not control and are not responsible CreatorIQ’s collection or use of your information. You may find out more about how CreatorIQ collects, stores, and uses your information by accessing its privacy policy. CreatorIQ’s privacy policy is available at https://www.creatoriq.com/legal/privacy-policy.

    Your participation in BoxLunch’s brand ambassador program is subject to the program Terms and Conditions. If you have not done so already, please review the program terms and conditions located at https://www.boxlunch.com/customer-service/partnerships/bl-collective/.

    Modernization of Cosmetic Regulations Act . If you submit a complaint of a potential Serious Adverse Event related to a cosmetic product purchased from any Hot Topic Brands, in addition to the information set forth in Section I, we may also collect (i) Protected Classification Characteristics, such as age, sex/gender, race and ethnicity, and (ii) medical or health information, such as details of any adverse health events you experienced in connection with the cosmetic product, the nature of the adverse health event, and any medical treatment received in connection with the event. We collect and use this information only for purposes of complying with our obligations under the Modernization of Cosmetics Regulations Act (MoCRA). All information collected will be kept confidential and used in compliance with applicable laws, rules, and regulations. Under certain circumstances, this information may be shared with the Food and Drug Administration (FDA) as required under MoCRA.


    IV. WHEN DO WE SHARE INFORMATION?

    To accomplish the purposes listed above, we share the information we collect:

  • With service providers, including businesses, professionals, or technical support providers to help us operate our business and the Services by doing things like processing your payment and shipping your order, facilitating chat functions, automating the process to enter into sweepstakes, or analyzing sales data to help us develop new products.

  • With third parties promoting sweepstakes, contests, and other promotions, if you choose to enter one of our promotions, we may disclose your information to third parties or the public in connection with running the promotion or announcing winners.

  • With Affiliates. We may share personal information with and among our parent company, subsidiaries, affiliates, or their successors or assigns.

  • With co-sponsors, when you use certain areas of our Sites and Apps, you may be interacting with third parties, such as advertisers that provide products and services or rewards programs. We may share information with these third parties if you participate in a co-branded, co-sponsored, or jointly presented promotion, contest, survey, voting feature, or service.

  • With marketing partners, such as vendors who help us place ads, customize them to certain audiences or users, understand whether those ads are successful, and improve our marketing efforts. We may also share with our marketing partners that may have offers of interest to you.

  • For legal matters; safety. We may be permitted or required by law to access and disclose your information to respond to subpoenas, judicial processes, or government requests and investigations, or in connection with an investigation on matters related to public safety. We may disclose your information to protect the security of our Sites and Apps, servers, network systems, and databases. We also may disclose your information as necessary, if we believe that there has been a violation of our Terms of Use, any other legal document or contract related to our Services, or the rights of any third party.

  • Upon a sale or transfer of our business or assets, if we sell or purchase assets during the normal course of our business. If another entity acquires us or any of our assets, information we have collected about you may be transferred to such entity. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, such information may be considered an asset of ours and may be sold or transferred to third parties.

  • If it is in aggregate, anonymous, or deidentified form. We may aggregate, anonymize, or de-identify your Personal Information and share it with third parties for marketing or analytics. Data that is aggregated, anonymized or de-identified is not Personal Information as that term is defined under California law

  • Elsewhere at your direction. At your direction or request, or when you otherwise consent, we may share your information.

  • V. COOKIES

    Our Sites and Apps use cookies, tags, pixels, software development kits, and similar technologies (“Cookies”) to provide, customize, evaluate, improve, and protect our Services. When you access the Sites and Apps, we (including companies we work with) may place cookies on your website browser, device, or hard drive. Cookies collect online identifiers such as your IP address, device identifier, advertising identifier, or similar unique digital identifier, and use them to track your online activity. We use that information to allow us to understand how users navigate to and around our website, view different pages, access content and request Services. This information may be used by Hot Topic Brands or our service providers to draw inferences and create a profile about your consumer preferences or trends. If you want to remove or block cookies, you may be able to update your browser settings. You can also find instructions on how to manage cookies on different types of web browsers at www.allaboutcookies.org.


    VI. YOUR CHOICES AND OPT-OUTS

    We provide our customers with the opportunity to opt-out of having their information used for purposes not directly related to placement, processing, fulfillment, or delivery of a product or service under certain circumstances.

    To opt-out of marketing communications, please use one of these convenient methods:

  • Email Offers. If you do not want to receive marketing emails from us, click the unsubscribe link in the footer of the marketing email. You may also opt-out of receiving emails from us by sending an email to internetadministrator@boxlunch.com with “Do Not Email” in the subject line.

  • Direct Mail Offers. If you do not want us to send you any promotional offers through US mail, you may email us at internetadministrator@boxlunch.com with “Do Not Mail” in the subject line. You can also opt-out of having direct mail materials sent to you by visiting http://optout.boxlunch.com.

  • Telemarketing. If you do not want to receive marketing phone calls or text messages from us, please inform us that you no longer want to receive calls from Hot Topic Brands when you receive a call from us or reply STOP to a text message from us. You can also opt-out of telemarketing by contacting our customer service department.

  • Marketing Communications From Other Hot Topic Brands. If you do not want to receive marketing communications from one or more brands within the Hot Topic Brands family, you must opt-out individually from each of the brands from which you are receiving brand-specific marketing communications. Your instructions to limit the use of your information for these purposes will be processed as soon as reasonably practicable. Additionally, we are not responsible for informing third parties (including without limitation our third-party service providers or partners) with whom we have already shared your Personal Information of any changes requested pursuant to this section.

  • Updating Your BoxLunch Account. You can verify, correct, or update certain information associated with your account by logging into your profile. You are responsible for maintaining the accuracy of this information.

  • Deactivating Your BoxLunch Account. You may deactivate your account, however we may still retain certain information for analytic purposes and recordkeeping integrity, as well as to prevent fraud, resolve disputes, enforce our Terms of Use or other policies, take actions we deem necessary due to technical and legal requirements, and as dictated by constraints related to the security, integrity, and operation of our Sites and Apps.


  • VII. YOUR CALIFORNIA PRIVACY RIGHTS/NOTICE AT COLLECTION

    1. California Rights

    California residents may have additional rights over their Personal Information. Subject to certain exceptions and limitations, California residents have the right to:

  • Request that we tell you (i) the categories of “personal information” (as that term is defined by the California Consumer Privacy Act (CCPA) and/or the California Privacy Rights Act (CPRA)) we have collected, sold, or shared about you and other consumers, (ii) the sources of that information, (iii) the business or commercial purposes for collecting, selling or sharing the personal information; and (iv) the categories of third-parties to whom we have disclosed, sold or shared personal information.

  • Request that we provide you with a copy of your personal information.

  • Request that we delete personal information that we have collected from you. We may not delete all of your personal information if one of the exceptions to the CCPA or CPRA applies.

  • Opt-out of the sale or sharing of your personal information.

  • Direct us to limit the use or disclosure of your sensitive personal information to only the purposes specified in the CCPA or CPRA.

  • Correct inaccurate personal information that we hold about you.

  • Opt-out of automated decision-making, including profiling, that we use to evaluate certain qualifications as part of the recruitment process.

  • Not be discriminated against for exercising any of your rights. We will not discriminate against you, deny you services, charge you a different price, or provide you with a lesser quality of services if you exercise any of your rights.

  • 2. How to Exercise These Rights.

    To submit a request to exercise these rights you may contact us at:

  • NUMBER: (844) 325-9138
  • WEBFORM: Click Here.

  • If you make a request, we will acknowledge we have received it within ten days. If you do not receive a response, please ensure your request was submitted properly or call us at 855-463-3646.

    Verification. For all requests, you must provide us with your first and last name, email address, phone number, and mailing address. We will use this information to verify your identity by matching the information we have collected against the information you have provided. Failure to provide the foregoing information may prevent us from processing your request.

    Designating an Authorized Agent. You may designate an agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow your agent to act on your behalf. Such permission should be sent via email to privacy@boxlunch.com. If you are a parent or legal guardian, you may exercise these rights on behalf of your child.

    Do Not Track Requests. Some web browsers or smartphones have the ability to set “Do Not Track” requests to block user activity from being tracked across web pages or devices. Our Sites and Apps do not recognize “Do Not Track” signals. However, Hot Topic Brands recognize and honor Global Privacy Control (GPC) requests received from qualifying California residents.

    3. Use and Disclosure of Personal Information

    We may also disclose your Personal Information by selling it to third parties or sharing it for cross-context behavioral advertising purposes, subject to your right to opt-out of this use of your Personal Information. This selling or sharing does not include information about individuals we know are under age 16. In the preceding twelve (12) months, Hot Topic Brands has disclosed, sold or shared the following categories of personal information to the categories of third parties indicated in the chart below. In the preceding 12 months, we have not used or disclosed sensitive personal information for purposes to which the right to limit use and disclosure applies under the CCPA or CPRA.

    Personal Information Category

    Category of Third Parties to Whom It Was Disclosed

    Category of Third Parties to Whom It Was Sold

    Category of Third Parties to Whom It Was Shared

    Personal identifiers

    Payment processors, marketing, analytics, and advertising partners, professional advisors, operating systems and platforms, customer relationship management service providers, security and fraud detection service providers, web hosting service providers, and data storage providers.

    None

    None

    Financial and commercial information

    Payment processors, marketing, analytics, and advertising partners, professional advisors, operating systems and platforms, customer relationship management service providers, security and fraud detection service providers, web hosting service providers, and data storage providers.

    None

    None

    Audio, electronic, and visual information

    Marketing, analytics, and advertising partners, professional advisors, operating systems and platforms, customer relationship management service providers, security and fraud detection service providers, web hosting service providers, and data storage providers.

    None

    None

    Communications

    Marketing, analytics, and advertising partners, professional advisors, operating systems and platforms, customer relationship management service providers, security and fraud detection service providers, web hosting service providers, and data storage providers.

    None

    None

    Internet network activity

    Marketing, analytics, and advertising partners, professional advisors, operating systems and platforms, customer relationship management service providers, security and fraud detection service providers, web hosting service providers, and data storage providers.

    Marketing, analytics, and advertisings partners.

    Marketing, analytics, and advertisings partners.

    Geolocation information

    Marketing, analytics, and advertising partners; operating systems and platforms, and data storage providers.

    Marketing, analytics, and advertisings partners.

    Marketing, analytics, and advertisings partners.

    Protected classification characteristics

    BoxLunch Brand Ambassador program partners, and operating systems and platforms.

    None

    None

    4. Selling or Sharing of Personal Information; Opt-Out and Opt-In Rights

    If you are age 16 or older, you have the right to direct us to not sell or “share” (as that term is defined under the CPRA) your Personal Information at any time (the "right to opt-out"). We do not sell or share the personal information of consumers we actually know are less than 16 years old, unless we receive affirmative authorization (the "right to opt-in") from either the consumer who is between 13 and 15 years old, or the parent or guardian of a consumer less than 13 years old. Consumers who opt-in to personal information sales may opt-out of future sales at any time.

    To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the BoxLunch website (https://www.boxlunch.com/) and clicking the link with the title "Do Not Sell or Share My Personal Information."

    Do Not Sell or Share My Information. We categorize each cookie on our website based on its type, for example, a targeting or marketing cookie. Then we put a “tag” on each category of cookie which allows us to deactivate all corresponding cookies with that tag if a user opts out, preventing the corresponding cookies from being used. You may opt-out of targeting and marketing cookies through the "Do Not Sell or Share My Information" link at the bottom of any BoxLunch webpage. While these cookies may still appear visible after opting-out, no data is collected or shared because the cookies are inactive and unused.

    If you choose to use the Global Privacy Control (“GPC”) browser signal, you will only be opted out of online sales or sharing of Personal Information, and will need to turn it on for each browser you use. Disabling all cookies will also only opt you out of online selling or sharing relating to cookies. To submit a request to opt out of sales and sharing which would not otherwise be controlled by GPC or cookies, please use our webform or call us at (844) 325-9138.

    Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sales at any time by visiting the same “Do Not Sell My Personal Information” link at the bottom of any BoxLunch webpage.

    5. Other Consumer Rights Information

    Complaints. Under California Civil Code Section 1789.3, we are required to provide California residents with the following information:

  • Unless otherwise expressly stated, this Site is provided without charge.
  • To file a complaint regarding this Site or to receive further information regarding use of this website, please contact us via email at privacy@boxlunch.com. You also may contact the Complaint Assistance Unit of the Division of Consumer Services of California’s Department of Consumer Affairs in writing at 400 R Street, Suite 1080, Sacramento, California 95814 or by telephone at (916) 445-1254 or (800) 952-5210.

  • Removal of Content for Minors Under the Age of 18. If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to privacy@boxlunch.com. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested

    Third-Party Marketing Opt Out. If you are a California resident, you may request information about our disclosure of Personal Information to third parties or affiliated companies for their direct marketing purposes. To make such a request, please contact us at privacy@boxlunch.com. You must put the statement “Third-Party Marketing Opt-Out” in the subject field


    VIII. NEVADA PRIVACY RIGHTS

    If you are a Nevada resident, you may request that we stop selling certain categories of personal information that we collect. To submit a request please email us at privacy@boxlunch.com or call us at (844) 325-9138. For all requests, you must provide us with your name, email address, phone number, and mailing address so that we can verify your identity by matching the information we have collected against the information you have provided. Failure to provide all of the foregoing information may prevent us from processing your request.


    IX. COLORADO, CONNECTICUT, MONTANA, OREGON, TEXAS, AND VIRGINIA PRIVACY RIGHTS

    This section applies to you if you are a resident of Colorado, Connecticut, Montana, Oregon, Texas, or Virginia.

    We set forth above the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared.

    Your Rights. Subject to certain exceptions and limitations, residents of Colorado, Connecticut, Montana, Oregon, Texas, and Virginia have the following rights:

  • You have the right to request that we confirm whether or not we are processing your personal data and to access your personal data.

  • You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format that allows for data portability.

  • You have the right to correct inaccurate personal data that we hold about you, taking into account the nature of the personal data and the purposes of the processing of the data.

  • You have the right to request that we delete personal information that we have collected from you or obtained about you.

  • You have the right to opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) automated decision-making and profiling that is done in furtherance of decisions that produce legal or similarly significant effects concerning you.

  • Exercising Your Rights. To exercise any of your rights, please use our webform or call us at (844) 325-9138. For all requests, you must provide us with your name, email address, phone number, and mailing address. We will use this information to verify your identity by matching the information we have collected against the information you have provided. Failure to provide the foregoing information may prevent us from processing your request.

    Designating an Authorized Agent. You may designate an agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow your agent to act on your behalf. Such permission should be sent via email to privacy@boxlunch.com. If you are a parent or legal guardian, you may exercise these rights on behalf of your child.

    Appealing Our Decision. If we refuse to take action on your request, you may appeal our decision within a reasonable period of time, not to exceed 90 calendar days, from the date of your receipt of our response. You may exercise your appeal rights by sending an email to privacy@boxlunch.com. You must insert the statement “Data Rights Decision Appeal” in the subject field of the email.

    Do Not Sell or Share My Information. We categorize each cookie on our website based on its type, for example, a targeting or marketing cookie. Then we put a “tag” on each category of cookie which allows us to deactivate all corresponding cookies with that tag if a user opts out, preventing the corresponding cookies from being used. You may opt-out of targeting and marketing cookies through the "Do Not Sell or Share My Information" link at the bottom of any BoxLunch webpage. While these cookies may still appear visible after opting-out, no data is collected or shared because the cookies are inactive and unused.

    Opt-Out Preference Signals. If you have enabled an opt-out preference signal on your browser or extension, we will treat such requests as a valid request to opt you out of the processing of personal information for purposes of targeted advertising, sale of personal information, or both, as indicated by the mechanism, for the associated browser or device. You will only be opted out of online targeted advertising or sales of personal information, and will need to turn it on for each browser you use. Disabling all cookies will also only opt you out of online selling or sharing relating to cookies. Please note that we may not be readily able to associate your personal information with your IP address or Device ID. To submit a request to opt-out of sales and sharing offline which would not otherwise be controlled by cookies, please use our webform or call us at (844) 325-9138.


    X. UTAH PRIVACY RIGHTS

    This section applies to you if you are a resident of Utah.

    We set forth above the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared.

    Your Rights. Subject to certain exceptions and limitations, residents of Utah have the following rights:

  • You have the right to request that we confirm whether or not we are processing your personal data and to access your personal data.

  • You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format that allows for data portability.

  • You have the right to request that we delete personal information that we have collected from you or obtained about you.

  • You have the right to opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) automated decision-making and profiling that is done in furtherance of decisions that produce legal or similarly significant effects concerning you.

  • Exercising Your Rights. To exercise any of your rights, please use our webform or call us at (844) 325-9138. For all requests, you must provide us with your name, email address, phone number, and mailing address. We will use this information to verify your identity by matching the information we have collected against the information you have provided. Failure to provide the foregoing information may prevent us from processing your request.

    Designating an Authorized Agent. You may designate an agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow your agent to act on your behalf. Such permission should be sent via email to privacy@boxlunch.com. If you are a parent or legal guardian, you may exercise these rights on behalf of your child.

    Do Not Sell or Share My Information. We categorize each cookie on our website based on its type, for example, a targeting or marketing cookie. Then we put a “tag” on each category of cookie which allows us to deactivate all corresponding cookies with that tag if a user opts out, preventing the corresponding cookies from being used. You may opt-out of targeting and marketing cookies through the "Do Not Sell or Share My Information" link at the bottom of any BoxLunch webpage. While these cookies may still appear visible after opting-out, no data is collected or shared because the cookies are inactive and unused.

    Opt-Out Preference Signals. If you have enabled an opt-out preference signal on your browser or extension, we will treat such requests as a valid request to opt you out of the processing of personal information for purposes of targeted advertising, sale of personal information, or both, as indicated by the mechanism, for the associated browser or device. You will only be opted out of online targeted advertising or sales of personal information, and will need to turn it on for each browser you use. Disabling all cookies will only opt you out of online selling or sharing relating to cookies. Please note that we may not be readily able to associate your personal information with your IP address or Device ID. To submit a request to opt-out of sales and sharing offline which would not otherwise be controlled by cookies, please use our webform or call us at (844) 325-9138.


    XI. THIRD-PARTY CONTENT, LINKS, AND PLUG-INS

    The Sites and Apps may have links to third-party websites and mobile applications, which may have privacy policies that differ from our own. We are not responsible for the practices of such third-party websites and mobile applications. Our Sites and Apps may also offer you the ability to interact with social plugins from social media sites, which may allow us and/or the social media site to receive data from or about you. In some cases, we may know that you clicked on a social plugin, such as a Twitter Follow button, or receive other information from the social media sites. Similarly, if you have previously provided Personal Information to a third party operating a plug-in on the Sites or Apps, then such third party may recognize you on the Sites or Apps. Your use of social network plugins is subject to each social media site’s privacy policy, which may be different from ours, so please read those policies carefully to understand their policies and your options. As with linked sites, we have no control over the information that is collected, stored, or used by social network plugins, and are not responsible for the practices of such sites.


    XII. PUBLIC FORUMS

    Any information you may disclose on our Sites or Apps, in blogs, on message boards, in chat rooms, or on other public areas on the Sites or Apps or other third-party websites that the Sites or Apps may link to, becomes public information. Please exercise caution when disclosing Personal Information in these public areas.


    XIII. CHILDREN’S PRIVACY

    Protecting children’s privacy is important to us. We do not direct the Sites or Apps to, nor do we knowingly collect any Personal Information from, children under the age of 13. If we learn that a child under the age of 13 has provided Personal Information, we will use reasonable efforts to promptly remove such information.


    XIV. DATA STORAGE, RETENTION, AND SECURITY

    Any Personal Information we collect will be stored on servers in the United States and subject to the laws of the United States, where the data protection and other laws may differ from those of other countries. Your Personal Information may be disclosed in response to inquiries or requests from government authorities or to respond to judicial process in the countries in which we operate.

    We retain Personal Information in identifiable form only for as long as necessary to fulfill the purposes for which the Personal Information was provided to us or, if longer, to comply with legal obligations, to resolve disputes, to enforce agreements and similar essential purposes. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

    We take precautions intended to help protect information that we process but no system or electronic data transmission is completely secure. Any transmission of your Personal Information is at your own risk and we expect that you will use appropriate security measures to protect your Personal Information.

    You are responsible for maintaining the security of your account credentials for the Services. We will treat access to the Services through your account credentials as authorized by you. Unauthorized access to password-protected or secure areas is prohibited and may lead to criminal prosecution. We may suspend your use of all or part of the Services without notice if we suspect or detect any breach of security. If you believe that information you provided to us is no longer secure, please notify us immediately using the contact information provided below.

    If we become aware of a breach that affects the security of your Personal Information, we will provide you with notice as required by applicable law. To the extent permitted by applicable law, we will provide any such notice that we must provide to you under applicable law at your account’s email address. By using the Services, you agree to accept notice electronically.


    XV. CHANGES TO THIS PRIVACY POLICY

    We reserve the right, at our sole discretion, to change, modify, add, remove, or otherwise revise portions of this Privacy Policy at any time. When we do, we will post the change(s) on the Sites and Apps. Your continued use of the Sites and Apps following the posting of changes to these terms means you accept these changes. If we change the Privacy Policy in a material way, we will take reasonable steps to notify you. The “Last Updated” legend above indicates when this Privacy Policy was last revised.


    XVI. HOW TO CONTACT US

    If you have any questions or concerns about this Privacy Policy or the practices described herein, you may contact us at privacy@boxlunch.com, 18305 East San Jose Avenue, City of Industry, CA 91748, or 855-463-3646.


    Not what you were looking for? Go Back.