Do Not Sell or Share My Personal Information

This notice applies to California residents and supplements our general Privacy Policy. It is provided pursuant to the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act of 2020 ("CPRA"). Terms used in this notice have the meanings given to them in those laws.

Personal information we collect

In the preceding 12 months, we have collected the following categories of personal information from California consumers. For each category, the examples below are not exhaustive.

Identifiers: name, email, phone number, postal address (when supplied), IP address, online identifiers from cookies and similar technologies.

Customer records (Cal. Civ. Code § 1798.80(e)): contact information submitted through our forms, such as catering and event requests.

Protected classification characteristics: limited employment-related information voluntarily supplied on job applications (for EEO compliance), where you choose to provide it.

Commercial information: order history processed through our ordering partners.

Internet or electronic network activity: browsing history on the Site, interaction with emails, and referring URLs.

Geolocation data: approximate location derived from IP address only (not precise GPS).

Professional or employment-related information: resumes, cover letters, and prior work history submitted through the careers forms.

Inferences drawn from the above to create a basic profile reflecting a consumer's preferences (for example, which location they tend to visit).

Sensitive personal information: we do not intentionally collect categories of sensitive personal information as defined by CPRA (such as Social Security numbers, precise geolocation, or racial or ethnic origin). If you include any such information voluntarily (for example, in a resume), we process it only for the purpose you supplied it.

Sources of personal information

• Directly from you (forms, email, phone calls, in-restaurant interactions).
• Automatically from your device or browser when you visit the Site.
• From service providers — for example, analytics platforms, form handlers, and ordering partners.
• From publicly available sources or social media platforms where you have interacted with us.

Business and commercial purposes for collection

• Performing the services you request (answering inquiries, processing catering and event bookings, fulfilling orders via our partners, reviewing job applications).
• Operating, maintaining, and securing the Site.
• Debugging and error resolution.
• Analytics and Site improvement.
• Marketing our own products and services to people who have expressed interest.
• Compliance with legal obligations and protection of rights, property, and safety.

Categories disclosed to third parties

In the preceding 12 months, we have disclosed the following categories to the following types of recipients for business purposes:

Identifiers and Internet activity — disclosed to our hosting, security, and analytics service providers (Vercel, Cloudflare, Google Analytics 4) for the purpose of operating and measuring the Site. For US visitors, analytics disclosures occur by default unless you opt out; for visitors in the EEA, UK, and Switzerland, only after consent is granted.

Customer records and identifiers — disclosed to our transactional email provider (Resend) so that contact, catering, event, fundraiser, careers, and newsletter form submissions can be delivered to our team. Resend processes the message on our behalf and forwards it to our Google Workspace inbox at hello@elpueblomex.com.

Commercial information — disclosed to our ordering partner (order.online) to fulfill orders you choose to place.

Identifiers and customer records — disclosed in response to legal process when we are required to do so.

Sale or sharing of personal information

We do not sell personal information for monetary or other valuable consideration. We do use advertising and conversion technologies — Google Ads remarketing and conversion tracking, and the Meta/Facebook Pixel where enabled — that may constitute "sharing" for cross-context behavioral advertising as defined under the CCPA/CPRA. In the US this occurs by default and you may opt out at any time (see below); in the EEA, UK, and Switzerland it occurs only after you opt in.

We do not have actual knowledge of selling or sharing personal information of consumers under 16.

Retention

We retain each category of personal information only as long as necessary for the purpose it was collected and any lawful recordkeeping requirement. See the Data Retention section of our Privacy Policy for representative time frames.

Your California privacy rights

Subject to certain exceptions, California residents have the following rights:

Right to know — request that we disclose (1) the categories of personal information we have collected about you; (2) the categories of sources; (3) the business or commercial purposes; (4) the categories of third parties to whom we disclosed it; and (5) the specific pieces of personal information we have collected about you.

Right to delete — request that we delete personal information we have collected from you, subject to exceptions (for example, we may retain information needed to complete a transaction, detect security incidents, comply with a legal obligation, or exercise a legal right).

Right to correct — request that we correct inaccurate personal information we maintain about you.

Right to opt out of sale or sharing — we use advertising technologies (Google Ads remarketing/conversion tracking, and the Meta/Facebook Pixel where enabled) that may be considered "sharing" for cross-context behavioral advertising. You can opt out at any time using the controls on our Do Not Sell or Share page, by declining marketing in the cookie banner, or via a Global Privacy Control signal, which we honor automatically.

Right to limit use of sensitive personal information — because we do not use sensitive personal information for purposes beyond those permitted by default, no additional limitation is necessary.

Right to data portability — receive the personal information you have provided to us in a readily usable format.

Right to non-discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercised your rights. We are permitted to offer financial incentives tied to personal information, but we do not currently do so.

How to submit a request

Email: hello@elpueblomex.com with the subject "California Privacy Request" and describe the right you are exercising.

By mail: El Pueblo Mexican Food — Privacy, 5965 Village Way, Suite E107, San Diego, CA 92130.

You may also contact any El Pueblo location by phone and ask to be directed to the Privacy contact.

Verification

To protect your information, we must verify your identity before responding to most requests. Verification generally requires that you provide information we can match against what we already have — for example, the email address you used to submit a form, the approximate date of your interaction, or the contents of a specific message.

For deletion and correction requests, we may require a signed declaration under penalty of perjury.

We do not use your verification information for any purpose other than verifying your request.

Authorized agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide written proof of their authority (for example, a signed permission or a valid power of attorney). We may still contact you directly to verify your identity or to confirm the request.

Businesses that provide consumer-privacy-request services must be registered with the California Secretary of State where required by law.

Response timing

We confirm receipt of your request within 10 business days and will respond substantively within 45 calendar days of receipt. If we need more time (up to an additional 45 days), we will tell you the reason and the extension period in writing.

Appeals

If you are dissatisfied with our response, you may appeal by replying to our decision email within 30 days, or by writing to hello@elpueblomex.com with "Privacy Appeal" in the subject line. We will respond to appeals within 45 days and, if we deny the appeal, will inform you of your right to contact the California Privacy Protection Agency or the California Attorney General's office.

Shine the Light

California Civil Code § 1798.83 allows California residents to request a notice disclosing categories of personal information we shared with third parties for their direct marketing in the preceding year. We do not share personal information for third-party direct marketing. To confirm, email hello@elpueblomex.com with "Shine the Light" in the subject line.

Minors

We do not knowingly collect personal information from children under 13 and do not sell or share the personal information of consumers we know to be under 16. If you are under 18 and have posted content you want removed, contact us and we will remove it.

Global Privacy Control

We recognize the Global Privacy Control (GPC) browser signal and treat it as a valid request to opt out of any "sale" or "sharing" of personal information (including for cross-context behavioral advertising) to the fullest extent applicable — automatically, before you interact with the cookie banner.

Changes to this notice

We will update this California Consumer Privacy Notice as our practices change or the law evolves. Material updates will be flagged on the Site. The "Last updated" date above reflects the current version.

Contact

Email: hello@elpueblomex.com (subject: "California Privacy")

Postal: 5965 Village Way, Suite E107, San Diego, CA 92130 (Attn: Privacy)