NOODLES & COMPANY PRIVACY NOTICE FOR VIRGINIA RESIDENTS

Last Updated On August 1, 2023

This Privacy Notice for Virginia Residents (the “VA Privacy Notice”) supplements the information contained in the Noodles & Company (“Noodles,” “we,” or “us”) Privacy Notice and applies solely to all visitors, users, and others who reside in the State of Virginia (“consumers” or “you”). We adopt this VA Privacy Notice to comply with applicable Virginia law, including the Virginia Consumer Data Protection Act, as amended from time to time (“VCDPA”) and any terms defined in the VCDPA have the same meaning when used in this VA Privacy Notice. Any other capitalized but undefined terms shall have the meanings set forth in the Privacy Notice.

Please note that some of our restaurants are owned and operated by franchisees, who are independent from us. This VA Privacy Notice does not apply to franchisees or to websites or mobile apps that they operate. Please refer to our applicable franchisees’ privacy notices for information on how they collect and use your information.

As used in this VA Privacy Notice, “Personal Data” means information that is linked or reasonably linkable to an identified or identifiable natural person. Personal Data does not include de-identified data, publicly available information, or data outside the scope of the VCDPA.

HOW WE COLLECT, USE, AND DISCLOSE YOUR PERSONAL DATA

We collect, use, and disclose your Personal Data as set forth in the Privacy Notice. If we use de-identified data, we also will maintain and use such de-identified data without attempting to re-identify such data.

Please note that the collection of precise geolocation is considered sensitive Personal Data under the VCDPA. We will obtain your explicit consent and provide you the ability to opt into such collection prior to any collection of this information.

If we use de-identified data, we also will maintain and use such de-identified data without attempting to re-identify such data.

RIGHTS AND CHOICES OF virginia RESIDENTS

The VCDPA also provides Virginia residents with specific rights regarding their Personal Data. This section describes the rights of Virginia residents under the VCDPA, and explains how to exercise those rights.

Opt-Out Rights

Our use of tracking technology, including cookies and related technology, may be targeted advertising under the VCDPA. If you would like to opt out of this advertising you may click “Do Not Sell Or Share My Personal Information” (also found at the bottom of the page), or you may broadcast the Global Privacy Control signal through your web browser or device. More information on Global Privacy Controls can be found here.

Access Rights

Virginia residents have the right to request that we disclose certain information to them about our collection and use of their Personal Data. You may request (see Exercising Rights) the following:

• confirmation of whether or not we are processing your Personal Data; and/or
• access to your Personal Data that we process.

Once we receive and a Virginia resident’s consumer request (see Exercising Rights), we will provide confirmation and access to the applicable Personal Data. Please also see Data Portability Rights for how we may provide the information.

Data Correction Rights

Virginia residents have the right to request that we correct inaccuracies in their Personal Data, considering the nature of the Personal Data and the purposes of the processing of the Personal Data. Once we receive and confirm your consumer request (see Exercising Rights), we will use commercially reasonable efforts to correct the inaccurate Personal Data.

Deletion Rights

Virginia residents have the right to request that we delete any of their Personal Data that we collected from or obtained about Virginia residents, subject to certain exceptions. Once we receive and confirm a Virginia resident’s consumer request (see Exercising Rights), we will delete their Personal Data from our records.

Data Portability Right

Virginia residents have a right to request that we provide a portable copy of the Personal Data that the Virginia consumer previously provided to us. Once we receive and confirm the consumer request (see Exercising Rights), we will provide a copy of your Personal Data, to the extent reasonably and technically feasible, in a readily useable format to transmit the data to another business.

EXERCISING RIGHTS

Only Virginia residents may make a “verifiable consumer request” (subsequently referred to as a “consumer request”) related to a Virginia resident’s Personal Data. A Virginia resident may also make a verifiable consumer request on behalf of their minor child. To be verifiable, a consumer request must include:

• provide sufficient information that allows us to reasonably verify that the Virginia resident is the person about whom we collected Personal Data or an authorized representative of the Virginia resident; and
• describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide a Virginia resident with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to that Virginia resident.

Making a consumer request does not require a Virginia resident to create an account with us, but we may require authentication of the consumer that is reasonable in light of the nature of the Personal Data requested, such as using an existing account to contact us.

To exercise the rights described above, please submit a consumer request to us by:

• Calling us at 720-214-1900; or
• Emailing us at [email protected].

INITIAL REQUEST RESPONSE TIMING AND FORMAT

We endeavor to respond to a consumer request within 45 days of its receipt. If we require more time (not to exceed 90 days), we will notify the Virginia resident within 45 days of receiving the request and indicate the reason for the extension. Any disclosures we provide will only cover the 12-month period preceding the receipt of a consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to a Virginia resident’s consumer request unless the request is excessive or manifestly unfounded, or a request was made more than twice in a 12-month period. If we determine that the request warrants a fee, we will tell the Virginia resident why we made that decision and provide them with a cost estimate before completing the request. Alternatively, we may decline to respond to the request and notify the Virginia resident of our reason for doing so.

Appeals TIMING AND FORMAT

If we decide that we cannot comply with a Virginia resident’s initial request, that Virginia resident has a right to appeal our decision. Any appeal should be sent to the place where the initial request was sent (see Exercising Rights). The appeal should clearly indicate that it is an appeal of an initial request and should include the initial request along with our response explaining why we cannot comply with the request. We will review all appeals and provide a response within 60 days of receiving the appeal, including the reasons we cannot comply with the request, if applicable. If we cannot comply with a request after an appeal is made, Virginia residents may submit a complaint to the Virginia Attorney General, which can be found here: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

NON-DISCRIMINATION

We will not process Virginia residents’ Personal Data in violation of state and federal laws that prohibit unlawful discrimination against Virginia residents. We will also not discriminate against a Virginia resident for exercising any of their VCDPA rights. Unless permitted by the VCDPA, we will not:

•    Deny a Virginia resident goods or services.
•    Charge a Virginia resident different prices or rates for goods or services.
•    Provide a Virginia resident a different level or quality of goods or services, including denial of goods or services.

CHANGES TO OUR PRIVACY NOTICE

From time to time, we may update this VA Privacy Notice. If our information practices materially change at some time in the future, we will post the updated VA Privacy Notice to our Site or Mobile App to notify you of these changes, and we will only use data collected from the date of the notice change for these new or different purposes. In the event we make a material change to how we use your Personal Data, we will provide you with an opportunity to opt out of such new or different use. The date this VA Privacy Notice was last revised is at the top of this page. You are responsible for periodically reviewing the Site and this VA Privacy Notice to check for any updates or changes.

CONTACT INFORMATION

If you have any questions or comments about this VA Privacy Notice, the ways in which Noodles collects and uses your data described below and in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under Virginia law, please do not hesitate to contact us at:

Phone: 1-833-568-6108
Website: http://www.noodles.com
Email: [email protected]
Postal Address:
Noodles & Company
Attn: Noodles Guest Relations
520 Zang Street, Suite D
Broomfield, CO 80021