Privacy Agreement

Published: September 1, 2021
Effective: September 1, 2021

Date Last Updated: September 1, 2021

PRIVACY NOTICE / YOUR PRIVACY RIGHTS

If you are a California resident, refer to section 12 for more information about your specific privacy rights.

If you are a resident of the European Economic Area (“EEA”, including European Union Member States, Iceland, Liechtenstein and Norway), Switzerland, or the UK, refer to section 13 for more information about your specific privacy rights.

1. Introduction

The GoBrands Inc. group of companies (operating as “Gopuff”), including all of its affiliated companies (“us,” “we,” or “our”) collects and processes information about you as described in this Privacy Notice (“Notice”). We are committed to protecting your privacy. This Notice contains details about how we collect, use, and share Personal Information that we obtain from and about you when you interact with us on our website, via our mobile app, via email, and through other online and offline interactions. Please read this Notice carefully.

Applicability: We collect information regarding the following current, past, and prospective categories of individuals:

  • customers and users of our websites, mobile apps and other online content on which this Notice is displayed;
  • independent contractors, including independent delivery drivers (“Driver Partners”) (unless a Driver Partner is considered an employee, in which case a separate employee privacy notice will apply);
  • representatives and employees of suppliers and other business partners; and
  • current, past, and prospective job applicants.

We may provide further supplemental notices, as appropriate.

This Notice does not apply to the following information:

  • Information about our employees and certain contractors and agents acting in similar roles. Such information is subject to a separate privacy notice that we will make available to those individuals.
  • Health or medical information. Such information is subject to a separate privacy notice that we will make available when relevant.
  • In the United States, information we collect from individuals with whom we engage in solely business-to-business communications and transactions, such as information about the employees of our business partners and customers.

Changes: We may update this Notice from time-to-time. The current Notice will be effective as of the Effective Date set forth above. Please check this Notice periodically for updates. If any of the changes are unacceptable to you, you should cease interacting with us. When required under applicable law, we will notify you of any changes to this Notice. When required under applicable law (and excluding the EEA, Switzerland, and the UK) , we will seek affirmative consent from you before making material changes to the way we handle Personal Information previously collected from you. If you do not provide such consent, Personal Information will continue to be used in a manner that is consistent with the version of this Notice under which it was collected.

2. Sources of Personal Information

“Personal Information” or “Personal Data” refers to any information relating to an identified or identifiable natural person or household.

We collect information about you and how you interact with us in several ways, including:

  • Information you provide to us directly. We collect information you provide to us directly. This includes when you register and communicate with us directly through our websites or mobile apps or other instances as described below.
  • When you apply for a job with us. We collect Personal Information directly from prospective employees, independent consultants, advisers and other prospective staff who submit applications for our consideration (e.g. via a dedicated, online talent management platform or via email communication). We may also receive Personal Information about job applicants from third parties who provide services to us, including but not limited to staffing or recruiting firms, internal or external referrals, and from other third parties who provide additional background information to us (i.e. references, background checks, etc).
  • Information collected when you drive for us. We collect information about you through our Driver Partner app, including your location while delivering and other information about your services to us.
  • Information collected/received when you/your company do business with us. We may collect and process Personal Information concerning representatives (e.g. employees) of our current, past, and prospective customers, suppliers, investors and business partners that such individuals or their company (e.g., acting as your employer) provide to us.
  • Information automatically collected or inferred from your interaction with us. We automatically collect technical information about your interactions with us when you use our websites and mobile apps (such as IP address, browsing preferences, and cart and purchase history.)
  • Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
  • Information from other third parties. We receive information about you and your interactions with us from third parties, such as from your friends or family, third party service and content providers, entities with whom we partner to sell products, telephone and fax companies, social media networks, data brokers, and others interacting with us.

We may combine information that we receive from the various sources described in this Notice, including third party sources and public sources, and use or disclose it for the purposes identified below.

3. Types of Personal Information We Collect

The types of information that we have collected about you during the previous 12 months are:

  • Identifiers, such as your name, alias, postal address, country of residence, unique personal identifier, online identifiers (such as various advertising identifiers), internet protocol (IP) address, email address, account name, phone number, social media identifiers (e.g., Twitter handle, Instagram name, etc.), driver’s license number, passport number, or other similar identifiers.
  • Customer Records, such as signatures and ID cards (presented to our drivers in instances where this is required for delivery of age-sensitive products, such as alcohol or tobacco).
  • Protected Class and Demographic Information, such as age, race (only where authorized under applicable local laws), gender, national origin, sex, disability (where allowed under local laws), citizenship, military or veteran status, education, or date of birth.
  • Financial Information, such as a bank account number for us to be able to charge for goods and services, and pay our Driver Partners and other contractors. We do not store your full credit/debit card numbers, as these are stored by our payment services/gate provider. We only store a tokenized ID of the last four digits of your card, expiration date and type.
  • Health or Medical Information, when your order contains prescription medication.
  • Commercial Information and Preferences, including records of personal property, creditworthiness, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
  • Internet or Other Electronic Network Activity and Device Information, such as your browsing history, search history, and information regarding your interactions with us (through our website and mobile apps, or through advertisements on third party platforms), and operating system/platform of your device.
  • Geolocation Information, such as longitude and latitude from your IP address or mobile device location. If you are our customer, we collect this when you submit your address at the time of order (if you enabled location sharing for our mobile app). If you are our driver, we collect this information while you are delivering the order.
  • Audio, Electronic, Visual, Thermal, Olfactory or Similar Information, such as full-face photographic images (when you apply for a job, sign-up as a user / driver or where we check your identity for delivery of age-sensitive products), video recordings / photos of our premises, call center recordings, or customer support chat logs.
  • Professional, Employment, or Education Information, such as job title, business address, employment history, or other professional information. This may also include information about your previous work performance provided by your former employers or other references provided by third parties and information regarding your right to work in the country, where the position for which you are applying is located (this may include citizenship/residency data, passport data, visa data, and work permit details).
  • Education Information, such as your education history, qualifications and certifications you hold, and other information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
  • Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

4. How We Use Your Personal Information

We may use each category of your information described above in the following ways:

  • To enable interactions between you and us and to provide our services to you, such as to facilitate online purchases of our products; process shipping, returns, and related location tracking (which is active only while our customer enters their address in our platform to order); register and administer your account, provide you with and support your interactions with us; diagnose, repair and track service and quality issues; facilitate an order, download, return, or exchange; provide requested product information; communicate with you about your account or our data practices; install and configure changes and updates to programs and technologies related to interactions with us; authenticate those who interact with us; or to respond to your requests, complaints, and inquiries.
  • To facilitate subscription programs, such as our FAM monthly/yearly subscription program to deliver to you the benefits associated with these programs when you fulfil the conditions outlined therein (and to verify you have done so), such as reduced delivery fees and other offers, as applicable from time-to-me.
  • Facilitate business relationship with you/companies, acting as our investors, suppliers and other business partners, such as to enter into contracts, provide you with updates as required under applicable laws and/or agreements with you, to coordinate sales orders and management, warranty management, credit and payment collection, compliance with relevant export control, anti-money laundering, accounting and other business-based legal requirements that require us to process your Personal Information.
  • Talent recruitment, including to process and evaluate your application for a position with us. We will carry out an initial screening of applications received and may choose to proceed to additional assessment rounds with some of the candidates where further information may be required. We will provide successful candidates with a dedicated notice for employees, as appropriate.
  • Driver Partner management, including to enter into agreements with you, ensure appropriate remuneration by collecting data about orders you have fulfilled through the driver app, to track your location in the course of delivery, assign deliveries to you, and manage any communications between us.
  • For our own internal business-improvement purposes, such as to evaluate or audit the usage and performance of programs and technologies related to interactions with us, including crash reporting; evaluate and improve the quality of your interactions with us and programs and technologies related to interactions with us; design new services; process and catalog your responses to surveys or questionnaires (e.g., customer satisfaction reviews); perform internal research for technological development and demonstration; conduct data analysis and testing; maintain proper business records and other relevant records.
  • Surveys and questionnaires. We may ask you to complete an online survey, opinion poll or other questionnaire in order to obtain your input on our services or relationship, which will help us improve our business practices.
  • For legal, safety, or security reasons, such as to comply with legal requirements; establish, exercise or defend against legal claims that we may have against you/pursue together with you, whether in court proceedings or in an administrative or out-of-court procedure; protect our safety, our property or rights of those who interact with us, or others; and detect, prevent, and respond to security incidents or other malicious, deceptive, fraudulent, or illegal activity.
  • In a de-identified, anonymized, or aggregated format. Depending on the applicable law, when converted to a de-identified, anonymized, or aggregated format, data may no longer constitute Personal Information and we may use this information for any purpose, as legally permitted.
  • For marketing. We may use your Personal Information to market our products or services or those of third parties, such as our business partners. We may use your Personal Information when you participate in marketing surveys, questionnaires, promotions, testimonials, online comments, product feedback, events, sweepstakes or other contests. We may audit aspects of our ad impressions. We may use your Personal Information for short-term transient use, including for contextual ad customization. We may use your Personal Information to enhance our content and to potentially send you commercial emails or other digital or voice communications.
    To opt-out of receiving promotional email messages or other digital or voice communications from us, please click on the "Unsubscribe" link contained at the bottom of the communication or by contacting us using the information in section 11 below.
    Some of our marketing materials and information may use tracking technologies and analytics tools to help us understand your preferences. For further information, please see Section 6.
  • Corporate transactions. We may use your Personal Information in order to comply with requests of a prospective or an actual purchaser interested in our companies and other assets, or in relation to a prospective or actual purchase of companies or assets by us.
  • For any other purposes for which you provide consent. 

5. With Whom We Share Your Personal Information

We may share your Personal Information with the categories of recipients described below:

  • Affiliates and subsidiaries: We may share your Personal Information within our group of companies, which includes parents, corporate affiliates, subsidiaries, business units and other companies that share common ownership for the purposes described above.
  • Service providers: We may share your Personal Information with service providers working on our behalf in order to facilitate our interactions with you or request or support our relationship with you, such as hosting service providers, IT providers, operating systems and platforms, internet service providers, data analytics companies, and marketing providers (e.g., we may share your email address with our outbound email marketing provider). We may contract with other companies to provide certain services, such as identity verification, email distribution, market research, promotions management and payment processing. We provide these companies with only the information they need to perform their services and work with them to ensure that your privacy is respected and protected. These companies are prohibited by contract from using this information for their own marketing purposes or from sharing this information with anyone other than with us, unless at our direction as part of providing the service or with your agreement.
  • Business partners: We may also provide your Personal Information or provide access to your Personal Information to our vendors and other business partners, such as shipping companies, brand partners, marketing and advertising companies, and our investors.
  • Fulfillment partners: We may provide your Personal Information or provide access to your Personal Information to entities that assist us in fulfilling your orders, such as local alcohol stores from which that portion of your order is obtained.
  • Professional advisors: We may share your Personal Information with various professional advisors such as recruitment agencies/professionals and lawyers, accountants, auditors, translators and where they advise us on our relationship.
  • For legal, security and safety purposes: We may share your Personal Information with third parties such as law enforcement or other government agencies and authorities and courts to comply with law or legal requirements; to enforce or apply our Terms of Use and other agreements; and to protect our rights and our property or safety of our users or third parties; or to otherwise establish, exercise and defend against legal claims (including by sharing data with opposing or other related parties to the proceedings and their professional advisors).
  • In connection with a corporate transaction: If we sell/acquire some or all of our assets, merge or are acquired by another entity, including through a sale or in connection with a bankruptcy, we will share your Personal Information with that entity.
  • The public: There may be opportunities for you to make public comments regarding us or our products. If you provide testimonials we will post your name along with the testimonial with your consent. If you provide feedback we will post your name along with the feedback with your consent. We may post anonymized testimonials and content feedback without your consent. Any Personal Information in posted testimonials or feedback, and any comments you otherwise post on a blog or forum, may be read, collected, or used by other users or the public.
  • With any entity to which you consent to us sharing your Personal Information. 

We may also de-identity, anonymize, or aggregate Personal Information to share with third parties for any purpose, as legally permitted.

6. How We Use Cookies and Automatic Data Collection Tools

We also collect information, via cookies, web beacons, pixels, tags or other tracking technologies, such as your Internet Service Provider and IP address, the date and time you access our website or mobile app, the pages you accessed while visiting our website or mobile app, and the Internet address from which you accessed our website or mobile app. Some cookies exist only during a single session and some are persistent over multiple sessions over time. We and our partners use these technologies to ensure basic functionality of our website and mobile app, to remember user preferences (including regarding your preferences regarding tracking technologies), maximize the performance of our website, mobile app, and services, provide you with offers that may be of interest to you, measure the effectiveness of our website, mobile app, and email campaigns and to personalize online content. These cookies and other technologies may be used to track you over time and across devices. When required by law, we only use these tracking technologies, when you have given us your consent to do so.

To provide you with a more relevant and interesting experience, we may work with third party companies to display ads or customize the content on our website or mobile app. These companies may use cookies and similar tracking technologies as described in this Notice to gather information about your visits to the website or mobile app, as well as your visits elsewhere on the Internet. These companies also may use this information to provide you with more relevant advertising known as interest-based advertising. For more information about third-party advertisers and how to prevent them from using your information, please visit https://www.networkadvertising.org/choices/. This is a site offered by the Network Advertising Initiative ("NAI") that includes information on how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members. The Digital Advertising Alliance (“DAA”) also offers a choice mechanism with respect to certain types of data collection and use by third parties available at www.aboutads.info. Opting out of interest-based advertising will not opt you out of all advertising, but rather only interest-based advertising from us or our agents or representatives. Similarly, asking our mobile apps not to track you/not agreeing or rejecting tracking technologies in our cookie banner/preference center/mobile app selection screen will only opt you out of those technologies, but not all advertising. Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may not accept to/refuse or delete cookies. If you do not accept/refuse or delete cookies, some of our website functionality may be impaired or some of the advertising served to you may not be relevant for you anymore. If you change computers, devices, or browsers, or use multiple computers, devices, or browsers, and delete your cookies, you may need to repeat this process for each computer, device, or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies. You can also find more information on managing cookies at All About Cookies - Manage Cookies.

Our websites use Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics cookies collect your IP address; however, because IP anonymization is used on this website, your IP address will be shortened (and therefore anonymized) as soon as technically possible and before it is stored or otherwise used in connection with Google Analytics. The anonymization process takes place within the European Union or the European Economic Area, except in exceptional cases, where your full IP address may be sent to a Google server in the United States and shortened there. We use the information collected by Google Analytics cookies to find out about how visitors use our website, to throttle request speed and for advertising tracking. Google will not combine the IP address sent by your browser in connection with Google Analytics with other data. You can prevent Google Analytics cookies from being stored by setting your browser software accordingly or opting-out of Google Analytics by downloading and installing the browser plug-in available here: https://tools.google.com/dlpage/gaoptout. You can also change settings regarding which cookies and tracking technologies placed on your device you allow us and our partners to read, in our cookie preference center. Changing these settings will not delete these cookies, but we will no longer be able to utilize them for the purposes you decided to turn off.

7. Security and Retention

We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use.

Your Personal Information will be retained as long as necessary to fulfil the purposes we have outlined in Section 4. of this Notice, unless we are required to do so by applicable law.

This includes retaining your data to provide you with the services requested and interact with you; maintain business relationship with you/your company; determine eligibility of candidates, prepare for future contract establishment and keep data to account for future job offers; to manage relationship with our drivers; to improve our business over time; to ensure ongoing legality, safety and security of our services and relationships or otherwise in accordance with our internal retention procedures. Once you / your company has terminated the contractual relationship with us or otherwise ended your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts, or for other legitimate business purposes, such as in order to enable easier future user onboarding, in order to evidence our business practices and contractual obligations, or to provide you with information about our products and services in case interest.

If you would like to know more about retention periods applicable to your particular circumstance, you can contact us using details provided in section 9 below.

8. Children's Privacy

Interactions with us are intended for individuals 16 years of age and older. Our interactions are not directed at, marketed to, nor intended for, children under 16 years of age. We do not knowingly collect any information, including Personal Information, from children under 16 years of age. If you believe that we have inadvertently collected Personal Information from a child under the age of 16, please contact us at the address below and we will use reasonable efforts to delete the child’s information from our databases.

9. External Links

When interacting with us you may encounter links to external sites or other online services, including those embedded in third party advertisements or sponsor information, that we do not control. We are not responsible for their privacy practices and data collection policies for such third party services. You should consult the privacy statements of those third party services for details.

10. Terms of Use

The End-User License and Terms of Service for interactions with us can be found on your country-specific Gopuff website.

11. Contact Info

If you have questions regarding this Notice, please contact us at: dpo@gopuff.com.

12. Your California Privacy Rights

This section applies to certain California residents and supplements the rest of our Notice above. This section does not apply to the following information:

  • Information about individuals who are not California residents;
  • Information about our own employees, contractors, agents, and job applicants. Such information is subject to a separate privacy notice that we will make available to individuals.
  • Information we collect from individuals with whom we engage in solely business-to-business communications and transactions, such as information about the employees of our business partners and customers;

Pursuant to the California Consumer Privacy Act of 2018, below is a summary of the Personal Information we collected from consumers, the sources from which we collected the Personal Information, the business or commercial purpose for which the Personal Information was collected and the categories of third parties with whom we share consumer Personal Information. The section references relate to the sections above in this Notice.

Source of Your Personal Information

The categories of sources of personal information are detailed in Section 2 above and are summarized as follows: (a) directly from you, (b) through automated technologies or interactions, (c) public sources, and (d) from third parties.

Uses of Your Personal Information

The business and commercial purposes for which we collect personal information are detailed in Section 4 above and include purposes, such as : (a) performing services, (b) auditing, (c) legal and compliance, (d) quality assurance, (e) security, (f) debugging, (g) short term, transient use, (h) internal research, (i) corporate transactions, and (j) marketing.

Sharing Personal Information

Our data sharing practices are detailed in the chart below and align with the information provided above in Section 3 (Personal Information), Section 5 (Sharing), and Section 6 (How We Use Cookies and Automatic Data Collection Tools).

Categories of Personal
Information We Collect

Categories of Third Parties With Whom We Disclose Personal Information for a Business Purpose

Categories of Third Parties To Whom We Sell Personal Information

Identifiers such as real name, postal address, country of origin, IP address, email address, account name, date of birth, other similar identifiers.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Cookie and automatic data collection entities

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6 described in Section 6

  • Entities to which you have consented to the disclosure

Personal information subject to the California Customer Records Act, such as signatures.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Cookie and automatic data collection entities

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Entities to which you have consented to the disclosure

Characteristics of protected classifications under California or Federal Law, such as age and gender.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6

  • Entities to which you have consented to the disclosure

Commercial information, including products or services purchased, obtained or considered, or other purchasing or consumer history.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Cookie and automatic data collection entities

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6

  • Entities to which you have consented to the disclosure

Internet or other electronic network activity information, including, but not limited to, status/HTTP status code, operating system and its interface, version of browsing software, device ID, other device information, browsing history, search history and information regarding a consumer’s interaction with an internet website, application or advertisement.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6

  • Entities to which you have consented to the disclosure

Geolocation data, such as your precise or approximate location derived from information from your mobile device.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Cookie and automatic data collection entities

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6

  • Entities to which you have consented to the disclosure

Other audio, electronic, visual, thermal, olfactory, or similar information, such as audio recordings of customer service calls.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Cookie and automatic data collection entities

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6

  • Entities to which you have consented to the disclosure

Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

  • Affiliates and subsidiaries

  • Service providers

  • Business partners

  • Fulfilment partners

  • Providers of legal, security, and safety assistance and resources

  • Entities involved in a corporate transaction

  • Cookie and automatic data collection entities

  • Entities to which you have consented to the disclosure

  • Business partners

  • Fulfilment partners

  • Companies that operate cookie and other online tracking technologies described in Section 6

To our knowledge, we do not sell Personal Information of anyone under 16 years of age.

Your Rights

Subject to legal limitations, certain California residents may exercise the following rights by our webform at https://gopuff.com/home/ccpa, by emailing us at ccpa@gopuff.com, or by calling 833-332-0021.

  • Right to Know. You have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting the Personal Information, the categories of third parties with whom we have shared your Personal Information, and the purpose for which we shared your Personal Information (“Categories Report”). You may also request information about the specific pieces of Personal Information we have collected about you (“Specific Pieces Report”).
  • Right to Delete. You have the right to request that we delete Personal Information that we have collected from you.
  • Right to Opt Out. You have the right to opt out of the sale of your Personal Information.

We will not discriminate against you, in any manner prohibited by applicable law, for exercising these rights.

Verification: In order to exercise your rights, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. If you are submitting a request on behalf of a household, we will need to verify each member of the household in the manner set forth above. For a Specific Pieces Report, we will request your name, email, and phone number to verify your identity and seek a signed declaration, under penalty of perjury, that you are who you say you are. For a Categories Report, we will request name, email, and phone number to verify your identity. For a Right to Delete request, we will request your name, email, and phone number to verify your identity.

Authorized Agents: Authorized agents may exercise rights on behalf of consumers, but we reserve the right to also verify the consumer directly as described above. Authorized agents may use the webform https://gopuff.com/home/ccpaand upload documentation demonstrating the agent has authority to exercise rights on the consumer’s behalf. At a minimum, we will require evidence of the agent’s identity, proof of registration with the California Secretary of State, and at least one of the following evidencing proof of your legal authority to act on the behalf of the individual consumer:

  • Written authorization signed by the Consumer; or
  • Certified copy of a Power of Attorney granted under Probate Code.

Timing: We will address Requests to Opt-out within 15 business days. We will respond to Requests to Delete and Requests to Know within 45 calendar days, unless we need more time in which case we will notify you and may take up to 90 calendar days total to respond to your request.

California Shine the Light: If you are a California resident, you may opt out of sharing your Personal Information with third parties for the third parties’ direct marketing purposes. Please contact us at ccpa@gopuff.com if you would like to do so.

13. Supplemental information for the EEA, Switzerland and the UK

The following terms supplement the Notice with respect to our processing of European Economic Area (i.e., European Union Member States, Iceland, Liechtenstein and Norway), Swiss and the UK Personal Data. To the extent applicable, in the event of any conflict or inconsistency between the other parts of the Notice and the terms of this Section 13., Section 13. shall govern and prevail with regards to the processing of EEA, Swiss and UK Personal Data.

  1. Data Controller

    Customers - The GoBrands entity with which you have a primary relationship with (such as the entity that provides services to and accepts payment from you; the entity that has provided you with marketing and promotional materials and communications; the primary entity in the region where you access our website or mobile application); is the controller of Personal Data collected from individuals within the scope of this Notice. In the majority of cases, this will be GoBrands Euro Intermediate Holdings, SARL, 6, Rue Eugene Ruppert, Luxembourg City, Luxembourg, unless we specifically inform you otherwise.

    Job Applicants - the relevant controller for your Personal Data is the GoBrands entity to which you have submitted your job application.

    Driver Partners - the relevant controller for your Personal Data is the GoBrands entity with which you have signed your contract.

    When there is more than one entity responsible for the processing, such as: when two GoBrands entities co-sign a business contract with your company; multiple GoBrands entities organize marketing campaign together; or when our EU HQ (GoBrands Euro Intermediate Holdings, SARL) helps local entities pick the right candidates for senior roles in the company; such entities are jointly responsible for the lawfulness of a specific processing activity (“Joint Controllers”).

    On some occasions, more than one GoBrands entity may process your Personal Data as independent controllers. If you have any questions about controllership, do not hesitate to contact us (see Section 9 for contact information).

  2. Legal bases for processing

    We rely on the following legal grounds for the collection, processing, and use of your Personal Data:

    • The processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. This includes instances when we need to enable interactions between you and us and to provide our services to you; as well as when we need to facilitate business relationship with you/companies acting as our investors, suppliers and other business partners; and in course of our talent recruitment process when we are negotiating with potential candidates; and when we conclude and fulfil our part of the contract with our drivers.

    • The processing is necessary for compliance with a legal or statutory obligation to which we are subject. This includes instances when we are required by various business laws to carry out various compliance checks (such as anti-money laundering) related to our customers, investors, suppliers, and other business partners. It may also include various local compliance obligations and licenses we have to comply with regarding the operation of our service, including engagement of our drivers. We will also process job applicant data if required by local laws to do so for purposes of fair hiring process.

    • The processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. This includes instances where we process your Personal Data for our own internal business-improvement purposes, certain survey and questionnaires we may carry out, and our marketing activities (for example by sending you digital direct marketing related to similar products/services we have provided to you), unless consent is required under applicable laws. We may also provide some of the auxiliary support to our services based on our legitimate business interest to do so, even though we are not required to do so under our contracts, including through various digital communication and other tools we provide in the course of our business / service relationship with you. We rely on our legitimate interest also in the course of our talent recruitment process for our initial interviews with potential candidates.

    • Where you provided us with your consent to the processing of your data for one or more specific purposes. This includes digital direct marketing communications, were your consent is required by law (for example if we are collecting your data on behalf of a third party), where you give us consent with keeping your application for other future opportunities, if such consent is necessary (otherwise, we would rely on our legitimate interest to do so), or in other instances where we asked for your consent in order to collect and process your Personal Data (we will inform you at each such occasion).

    • The processing is necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure;

    • The processing is necessary to carry out the obligations and exercising specific rights in the field of employment, social security and social protection law, where national employment laws regulate certain aspects of hiring procedures that require processing of sensitive Personal Data.

  3. Your Data Protection Rights

    Under the conditions set by applicable data protection laws, you may exercise the following rights regarding your Personal Data:

    • Access. You have the right to obtain confirmation from us if Personal Data is being processed, and related information; and the right to obtain a copy of your Personal Data undergoing the processing.

    • Rectification. You have the right to request the rectification of inaccurate Personal Data and to have incomplete data completed.

    • Objection. You have the right to object to the processing of your Personal Data for compelling and legitimate reasons relating to your particular situation, except in cases where legal provisions expressly provide for that processing.

    • Portability. You may receive your Personal Data that you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit it to other data controllers without hindrance. This right only exists if the processing is based on your consent or a contract and the processing is carried out by automated means.

    • Restriction. You may request to restrict the processing of your Personal Data in certain cases.

    • Erasure. You may request to erase your Personal Data if (i) it is no longer necessary for the purposes for which we have collected it, (ii) you have withdrawn your consent and no other legal ground for the processing exists, (iii) you objected and no overriding legitimate grounds for the processing exist, (iv) the processing is unlawful, or erasure is required to comply with a legal obligation.

    • Right to lodge a complaint. You also have the right to lodge a complaint with a supervisory authority, in particular in the country of the EEA, Switzerland or the UK where you reside, or where the issue that is the subject of the complaint occurred.

    • Right to refuse or withdraw consent. In case we ask for your consent to processing, you are free to refuse to give consent and you can withdraw your consent at any time without any adverse negative consequences. The lawfulness of any processing of your Personal Data that occurred prior to the withdrawal of your consent will not be affected.

    • Automated decision-making. You also have the right not to be subject to a decision based solely on automated processing (you can do so by contacting us at the Contact Info above) and to be given more information about why any such decision was made by contacting us using the Contact Details above.

  4. International Transfers of Personal Data

    Due to the global nature of our operations, some of the recipients mentioned in Section 5 of the Notice may be located in countries outside the EEA, Switzerland or the UK, which do not provide an adequate level of data protection as defined by data protection laws in the EEA, Switzerland and the UK. Certain third countries have been officially recognized by the EEA, Swiss and UK authorities as providing an adequate level of protection and no further safeguards are necessary. The below outlines how we protect your Personal Data when transferring it outside those countries.

    1. Intra-Group
      Intra-group international transfers will be to countries where GoBrands entities have offices, in particular the United States of America. The transfer of your Personal Data outside the EEA, Switzerland and the UK takes place on the basis of our intra-group data transfer agreements, which are based on EU and UK standard contractual clauses, as applicable.

    2. Third Parties
      Some of the third parties with whom we share Personal Data are also located outside the EEA, Switzerland or the UK in third countries, which do not provide an adequate level of data protection as defined by data protection laws in the EEA, Switzerland or the UK. Transfers to third parties located in such third countries take place using an acceptable data transfer mechanism, such as the EU/UK Standard Contractual Clauses, Binding Corporate Rules, approved Codes of Conduct and Certifications, on the basis of permissible statutory derogations, or any other valid data transfer mechanism issued by the EEA, Swiss or UK authorities.

      Please reach out to us using the Contact Info above, if you want to receive further information or, where available, a copy of the relevant data transfer mechanism.

  5. Data Protection Officer

    Please find below contact details for our EU data protection officer.

    Att: GoBrands EU/UK Data Protection Officer

    Email Address: dpo@gopuff.com