1. Introduction
Beach Hut, LLC (“Beach Hut Deli,” “we,” “us,” or “our”) operates the website located at beachhutdeli.com (the “Site”) and a mobile ordering application (the “App”), and franchises Beach Hut Deli restaurant locations across California. This Privacy Policy describes how we collect, use, disclose, and protect personal information, and describes the rights available to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). It supplements, and should be read alongside, the separate Privacy Statement provided by our online ordering partner, Toast, Inc., which governs your direct use of Toast’s ordering platform. This Policy applies to personal information we collect from consumers, website and app visitors, and customers who interact with Beach Hut Deli locations through the Site or App. It does not apply to personal information about our job applicants or employees, which is addressed separately.2. Categories of Personal Information We Collect
In the preceding 12 months, we have collected the following categories of personal information, as defined by the CCPA. The table below identifies each category, examples, and the source of collection.| CCPA Category | Examples | Source |
| Identifiers | Name, email address, phone number, IP address, account username | Directly from you; automatically via Site/App |
| Customer records | Order history, delivery/pickup address, payment card type (last 4 digits) | Directly from you; from Toast |
| Commercial information | Products purchased, order frequency, loyalty program activity | From Toast; directly from you |
| Internet/network activity | Browsing behavior on the Site, App usage data, interaction with emails | Automatically via cookies and analytics tools |
| Geolocation data | Approximate location (if location services are enabled in the App) | Automatically via the App, with permission |
| Inferences | Preferences inferred from order history (e.g., favorite menu items) | Derived internally from the above |
3. How We Use Personal Information
We use the personal information described above for the following business and commercial purposes:- Processing and fulfilling orders, including routing orders to the correct franchise location
- Creating and maintaining customer accounts
- Providing customer service and responding to inquiries, including privacy requests
- Sending order confirmations, receipts, and service communications
- Sending marketing communications where you have opted in, and honoring opt-outs
- Operating and improving the Site and App, including troubleshooting and analytics
- Personalizing content and offers based on order history, where permitted
- Detecting, investigating, and preventing fraud, security incidents, and illegal activity
- Complying with legal obligations and enforcing our terms
4. How We Disclose Personal Information
We disclose personal information to the following categories of recipients for the business purposes described in Section 3: Toast, Inc., our online ordering and point-of-sale platform provider- The specific Beach Hut Deli franchise location fulfilling your order
- Service providers who perform functions on our behalf (e.g., email delivery, hosting, analytics, customer support tools), under contracts that restrict their use of the information
- Professional advisors (e.g., legal, accounting) as needed
- Government authorities or other parties, where required by law, subpoena, or legal process, or to protect the rights, property, or safety of Beach Hut Deli, our customers, or others
- A successor entity in connection with a merger, acquisition, financing, or sale of assets
Sale and Sharing of Personal Information
“Sale” and “sharing” under the CCPA are defined broadly and can include disclosing information to advertising or analytics partners in exchange for something of value, including for cross-context behavioral advertising — even without an exchange of money. No sale/sharing: We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising as defined by the CCPA.5. Sensitive Personal Information
We do not collect Social Security numbers, government ID numbers, precise geolocation, financial account credentials, racial or ethnic origin, religious beliefs, health information, biometric information, or similar sensitive personal information, except as described in Section 2. Where sensitive personal information is collected, we use it only for purposes permitted under the CCPA and do not use or disclose it for purposes requiring an opt-in right to limit under Cal. Civ. Code §1798.121, unless you direct us to do so.6. Your California Privacy Rights
If you are a California resident, you have the following rights regarding your personal information, subject to certain exceptions: Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we have disclosed it, covering up to the 12 months preceding your request (or a longer period, at our discretion).Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., information needed to complete a transaction, comply with a legal obligation, or exercise free speech).
Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
Right to Opt Out of Sale/Sharing: You may direct us not to sell or share your personal information. See Section 4.
Right to Limit Use of Sensitive Personal Information: You may direct us to limit the use of sensitive personal information to purposes necessary to provide goods and services, where applicable.
Right to Non-Discrimination: We will not deny goods or services, charge different prices, or provide a different level of quality because you exercised a CCPA right.
Right to Portability: Where feasible, you may request a copy of your personal information in a portable, readily usable format.
7. How to Submit a Privacy Request
You, or an authorized agent acting on your behalf, may submit a request to know, delete, or correct personal information, or to opt out of sale/sharing, through either of the following methods:- Online:
- Emal: Charles@beachhutllc.com
Identity Verification
To protect your information, we will take reasonable steps to verify your identity before completing a request to know, delete, or correct, generally by matching the information you provide (such as name, email address, or order/account history) against records in our systems. We may request additional information if needed to verify a high-risk request (such as disclosure of specific pieces of information). If we cannot verify your identity, we may deny the request or limit it to actions that do not require verification (such as opt-out requests).Authorized Agents
An authorized agent may submit a request on your behalf by providing written proof of authorization; we may still require you to directly verify your own identity or confirm the agent’s authority.8. Response Timing
We will confirm receipt of a request within 10 business days and will respond substantively within 45 calendar days of receipt. If additional time is needed, we may extend the response period by an additional 45 days (90 days total), and will notify you of the extension and the reason within the initial 45-day period.9. Notice at Collection
At or before the point we collect personal information (such as at account creation or checkout), we provide a summary notice identifying the categories of personal information to be collected and the purposes for which they will be used, and a link to this Policy. [Confirm that a Notice at Collection is implemented at each relevant collection point on the Site and App — this is a distinct requirement from posting this Policy itself.]10. Financial Incentives
Beach Hut Deli does not currently offer a financial incentive, discount, or rewards program in exchange for the collection, sale, or sharing of personal information.11. Cookies, Tracking Technologies, and Global Privacy Control
The Site uses cookies and similar technologies to operate core features, remember preferences, and analyze usage. Where we share information via cookies for cross-context behavioral advertising (see Section 4), we honor the Global Privacy Control (GPC) signal as an opt-out of sale/sharing for the browser session in which it is received. We do not respond to browser Do Not Track signals, but we do honor Global Privacy Control as described above.12. Data Retention
We retain each category of personal information for the period, or based on the criteria, described below. We may retain information longer than these periods where necessary to comply with a legal obligation (for example, during an active tax audit), resolve a dispute, or enforce our agreements.| Category | Retention Period / Criteria | Basis |
| Identifiers (name, email, phone, IP address, username) tied to an order or account | For the duration of your customer relationship or account, plus 4 years after your last transaction or account closure | California’s 4-year statute of limitations for written contract claims (Cal. Code Civ. Proc. §337(a)) |
| Customer records (order history, delivery/pickup address, payment card type — last 4 digits) | 4 years from the date of the transaction | California sales/use tax recordkeeping requirement (18 Cal. Code Regs. §1698(i); CDTFA Publication 116) |
| Commercial information (products purchased, order frequency, loyalty activity) | 4 years from the date of the last relevant activity | Same tax-recordkeeping and contract-limitations basis above |
| Internet/network activity (browsing behavior, App usage, email interactions) | Up to 13 months from collection for analytics purposes, or until you opt out or delete your account | Data-minimization principle (Cal. Civ. Code §1798.100(c)); standard analytics retention windows |
| Geolocation data (approximate location via the App) | Only for the duration of the session in which location services are used, unless you enable a feature that requires longer retention | Data-minimization principle (Cal. Civ. Code §1798.100(c)) |
| Inferences (preferences derived from order history) | For as long as the underlying order history from which they are derived is retained | Tied to underlying data retention above |
| Records of your privacy rights requests (know/delete/correct/opt-out) and our response | At least 24 months from the date of your request | Cal. Code Regs. tit. 11, §7101(a) |
13. Children’s Privacy
The Site and App are not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. If we learn that a child under 13 has provided us with personal information, we will delete it.14. Security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.15. Third-Party Links
The Site and App may contain links to third-party websites, including Toast’s ordering platform. This Policy does not apply to those third parties, and we encourage you to review their privacy policies directly.16. California “Shine the Light”
In addition to CCPA rights, California’s “Shine the Light” law (Civil Code §1798.83) permits California residents to request certain information about our disclosure of personal information to third parties for their own direct marketing purposes in the preceding calendar year. To make such a request, contact us using the information in Section 20.17. Additional Rights for Oregon Residents
If you are a resident of Oregon, the Oregon Consumer Privacy Act (ORS 646A.570 et seq.) provides you the following rights, to the extent it applies to Beach Hut Deli’s processing of your personal data:- Right to Confirm and Access: You may confirm whether we are processing your personal data and obtain a copy of it, including in a portable, readily usable format where you have an account with us.
- Right to Correct: You may request that we correct inaccuracies in your personal data.
- Right to Delete: You may request that we delete personal data about you, including data you provided to us, data we obtained from another source, and derived data.
- Right to Opt Out: You may opt out of our processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects. As described in Section 4, we do not currently sell personal information or provide it to others for targeted advertising.
To submit a request, use the methods in Section 7. We will respond without undue delay and no later than 45 days after receiving your request, which we may extend by an additional 45 days (90 days total) where reasonably necessary; if we extend, we will notify you within the initial 45-day period and explain why.
Appeals
If we decline to act on your request, we will notify you of our decision and the reason for it, along with instructions for appealing. You may appeal by replying to that notice or contacting us using the methods in Section 7. We will decide your appeal within 45 days of receiving it and notify you in writing of our decision and the reasons for it. If we deny your appeal, we will provide information for contacting the Oregon Attorney General to submit a complaint (see https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/).