Employee-Applicant CCPA Notice
Last Updated: July 16, 2026
This notice describes the categories of personal information collected by FBG Management Co, FBG Fazolis Corporate Co, FBG Factory LLC and its affiliates (collectively, the “Company”) and the purposes for which such information may be collected and used. For additional information about the Company’s data privacy practices, please review our Privacy Policy.
Categories of Personal Information Collected
Identifiers and Contact information. This category includes names, addresses, telephone numbers, mobile numbers, email addresses, signatures, account names, dates of birth, bank account information, and other similar contact information and identifiers.
Protected Classification Information. This category includes characteristics of protected classifications under California or federal law.
Internet or Other Electronic Network Activity Information. This category includes, without limitation:
· all activity on the Company’s information systems, such as internet browsing history, search history, intranet activity, email communications, social media postings, stored documents and emails, usernames and passwords
· all activity on communications systems, including phone calls, call logs, voice mails, text messages, chat logs, app use, mobile browsing and search history, mobile email communications, and other information regarding an employee’s use of Company-issued devices.
Geolocation Data. This category includes, without limitation, GPS location data from Company-owned or issued mobile devices, applications, or vehicles.
Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information. This category includes, for example, information collected from cameras, thermometers, and similar devices.
Biometric Information. This category includes the use of biometric equipment, devices, or software to record your time worked, to enter or exit facilities or rooms, to access or use equipment, or for other business purposes. NOTE: this provision only applies to applicants for employment and employees of FBG Factory LLC.
Professional and Employment-Related Information. This category includes, without limitation:
· data submitted with employment applications, including salary history, employment history, employment recommendations, etc.
· background check and criminal history
· work authorization
· fitness for duty data and reports
· performance and disciplinary records
· salary and bonus data
· benefit plan enrollment, participation, and claims information
· leave of absence information, including religious and family obligations, and physical and mental health data, concerning employees and their family members
Education Information. This category includes, without limitation, education history.
Sensitive Personal Information. This category includes sensitive information such as:
· social security, driver’s license, state identification card, or passport number
· financial account information that allows access to an account, including log-in credentials, financial account numbers, passwords, etc.
· precise geolocation
· racial or ethnic origin, religious or philosophical beliefs, or union membership
· content of mail, email, and text messages (unless the Company is the intended recipient of the communication)
· genetic data
· biometric information for the purpose of uniquely identifying a consumer
· health information
· information related to a known child
· information concerning sex life or sexual orientation
Inferences Drawn from the Personal Information in the Categories Above. This category includes engaging in human capital analytics, including, without limitation, identifying correlations between certain characteristics and job success, analyzing data to improve retention, and analyzing employee preferences to inform HR policies, programs, and procedures.
Purposes for Which Personal Information, Including Sensitive Personal Information, Is Used
· Collecting and processing employment applications, including confirming eligibility for employment, background and related checks, onboarding, and related recruiting efforts.
· Processing payroll, other forms of compensation, and employee benefit plan and program design and administration including enrollment and claims handling, and leave of absence administration.
· Maintaining physician records and occupational health programs.
· Maintaining personnel records and record retention requirements.
· Communicating with employees and/or employees’ emergency contacts and plan beneficiaries.
· Complying with applicable state and federal health, labor, employment, benefits, workers compensation, disability, equal employment opportunity, workplace safety, and related laws, guidance, or recommendations.
· Preventing unauthorized access to, use, or disclosure/removal of the Company’s property, including the Company’s information systems, electronic devices, network, and data.
· Ensuring and enhancing employee productivity and adherence to the Company’s policies.
· Providing training and development opportunities.
· Investigating complaints, grievances, and suspected violations of Company policy.
· Designing, implementing, and promoting the Company’s diversity and inclusion programs.
· Facilitating the efficient and secure use of the Company’s information systems.
· Ensuring compliance with the Company information systems policies and procedures.
· Improving safety of employees, customers and the public with regard to use of Company property and equipment.
· Improving efficiency, logistics, and supply chain management.
· Improving accuracy of time management systems and attendance, including vacation, sick leave, and other leave of absence monitoring.
· Evaluating an individual’s appropriateness for a particular position at the Company, or promotion to a new position.
· Managing customer engagement and other legitimate business purposes.
· Responding to and managing legal claims against the Company and/or its personnel, including civil discovery in litigation.
· Facilitating other business administrative functions and strategic activities, such as risk management, information technology and communications, financial management and reporting, workforce and succession planning, merger and acquisition activities, and maintenance of licenses, permits and authorization applicable to Company operations.
Retention. We retain your personal information for as long as is necessary to process your application for employment, process your payroll, administer your benefits, and in accordance with the Company’s data retention schedule. We may retain your personal information for longer if it is necessary to comply with our legal or reporting obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, enforce our legal agreements and policies, address other legitimate business needs, or as permitted or required by applicable law. We may also retain your personal information in a deidentified or aggregated form so that it can no longer be associated with you. To determine the appropriate retention period for your personal information, we consider various factors such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we collect or process your personal information; and applicable legal requirements. Personal information does not include certain categories of information, such as publicly available information from government records, and deidentified or aggregated consumer information.
Disclosure. To carry out the purposes outlined above, the Company may disclose personal information to service providers or other third parties, such as background check vendors, third-party staffing vendors, information technology vendors, outside legal counsel, and state or federal governmental agencies. The Company does not sell or share, as those terms are defined under applicable law, the above categories of personal information. The Company may add to the categories of personal information it collects and the purposes for which it uses that information. The Company will inform you in the event it does so.
California Resident Individual Rights Requests. Individuals who are residents of the State of California have certain individual rights. Information about these rights and how to exercise them is available in the Company’s Privacy Policy.
Spouses, Dependents, and Associates. If you have knowledge that the Company collected personal information related to your spouse, dependent, or associate, please share a copy of this notice with all such individuals.
We reserve the right to amend this notice at any time without advance notice. Please direct questions about this notice to legal@fatbrands.com.
Employee-Applicant Privacy Policy
Last Updated: July 16, 2025
FBG Management Co, FBG Fazolis Corporate Co, FBG Factory LLC (the “Company”, “we” or “us” or “our”) is committed to protecting the privacy of your personal information. We created this Privacy Policy (the “Policy”) to inform you how we collect, store, use, disclose, retain, and protect your personal information, and your rights regarding that information.
Please read this Policy carefully before using any website or application where this Policy is posted (collectively, the “Site”) or otherwise submitting personal information to us. BY SUBMITTING PERSONAL INFORMATION TO US, INCLUDING IN CONNECTION WITH YOUR USE OF THE SITE, YOU CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL INFORMATION AS SET FORTH IN THIS POLICY AND OUR TERMS OF USE. If you do not consent to the collection, use, disclosure, and retention of your personal information as described in this Policy, please do not provide us such information.
We reserve the right to revise this Policy at any time. If we make any material changes, we will update the date noted above. We reserve the right to provide notice of any changes in other ways as well. Your use of this Site or submission of personal information after such changes constitutes your agreement to the Policy as amended. Except as you otherwise authorization, or as otherwise permitted or required by applicable law, we will handle your personal information in accordance with the terms of the Policy in effect at the time of the collection.
1. THE INFORMATION WE COLLECT
During the past 12 months, we may have collected the following categories of your personal information:
Identifiers and Contact Information. This category includes names, addresses, telephone numbers, mobile numbers, email addresses, signatures, account names, dates of birth, bank account information, and other similar contact information and identifiers.
Protected Classification Information. This category includes characteristics of protected classifications under California or federal law.
Education Information. This category includes, without limitation, information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, Sec. 1232g; 34 C.F.R. Part 99).
Internet or Other Electronic Network Activity Information. This category includes, without limitation, browsing history, search history, or a consumer’s interactions with a website, application, or advertisement.
Geolocation Data. This category includes, without limitation, location information collected when using one of our apps, devices, or vehicles.
Biometric Information. This category includes, without limitation, an individual’s physiological, biological, or behavioral characteristics used or intended for use – singly or in combination with each other or with other identifying data – to establish individual identity.
Professional and Employment-Related Information. This category includes, without limitation, information regarding job applications, information related to onboarding for payroll and benefits, and information needed for evaluating performance.
Sensitive Personal Information. This category includes:
· social security, driver’s license, state identification card, or passport number;
· log-in, financial account, debit card, or credit card number, in combination with any required security or access code, password, or credentials allowing access to an account;
· precise geolocation;
· racial or ethnic origin, citizenship or immigration status; religious or philosophical beliefs, or union membership;
· content of mail, email, and text messages (unless we are the intended recipient of the communication);
· genetic data;
· biometric information;
· health information;
· information related to a known child; and
· information regarding sex life or sexual orientation.
2. SOURCES OF INFORMATION
We may collect your personal information from the following sources:
You. We collect information you provide us in connection with your application for or employment with us. For instance, when you apply for a job with us, you may provide information regarding your educational and professional history. In connection with your employment with us, you may provide financial account information needed for payroll processing and government identification numbers needed to verify your identity and work authorization status.
Related Entities and Affiliates. We may collect information about you from our affiliates and other related parties.
Service Providers and Contractors. We may collect your personal information from service providers or contractors who collected information about you that relates to your application for or employment with us.
News Outlets, Social Media, Surveys, and Third Parties. In connection with your application for or employment with us, we or third parties on our behalf, may conduct research and other activities that result in the collection of your personal information.
Information Collected Automatically. As you navigate through and interact with our Site, we may compile statistical information concerning your usage of the Site through analytics services, such as those provided by Google Analytics. To do so, we may collect certain information about your equipment, browsing actions and patterns, including:
- Details of your visits to our Site, such as traffic data, location data, logs and other communication data and the resources that you access and use on the Site
- Information about your computer and internet connection, including your IP address, operating system, and browser type.
- Information about the type of device you are using, mobile ad identifiers, the time and length of your visit, and the website that referred you to our Site.
- Information about your preferences to make your use of the Site more productive, via the use of Cookies. For more information on Cookies, please see the Cookies and Other Tracking Technologies section. While all of this information can be associated with the IP address your computer had while you visited the Site, it will not be associated with you as an individual or with any other information you may submit through the Site or that we may store about you for any other purposes. We may use this information to generate aggregate statistics about visitors to our Site. Please check your web browser if you want to learn what information your browser sends or how to change your settings.
IMPORTANT: BY USING THE SITE, YOU CONSENT TO THE PROCESSING OF ANY PERSONAL INFORMATION FOR THE PURPOSES AND FUNCTIONS DESCRIBED ABOVE.
Do Not Track. “Do Not Track” is a privacy preference that you can set in your Internet search browser that sends a signal to a website that you do not want the website operator to track certain browsing information about you. However, because our Site is not configured to detect Do Not Track signals from a user’s computer, we are unable to respond to Do Not Track requests. Cookies set when you visit our Site may track you over time and across third party websites.
3. WHY WE COLLECT YOUR INFORMATION
In general, we will use the personal information we collect only for the purpose it was collected, for compatible purposes, as permitted or required by law, as necessary to carry out our contractual duties and obligations, and as otherwise provided in this Policy. For example, we may use your personal information in the following ways:
To Operate Our Site. We may use your personal information to enable use of this Site, provide you with information, or to administer the Site.
For Internal Use. We may use your personal information to: operate our business, including in connection with your application for or employment with us; review, improve, and monitor our website, applications, online services, and overall customer experience; provide customization to meet specific needs; assess trends, interests, and demands of customers, applicants and employees; and carry out our obligations and enforce our rights.
To Communicate with You. We may use your personal information to communicate with you, including sending messages about the availability of our Site, security, or various employment-related issues.
To Enforce Compliance with Our Terms and Agreements or Policies. When you access or use our Site, you are bound to our Terms of Use and this Policy. To ensure compliance, we may process your personal information in connection with monitoring, investigating, preventing, and mitigating prohibited, illicit or illegal activities on our Site. We may also process your personal information to: investigate, prevent or mitigate violations of our internal terms, agreements or policies; enforce our agreements with third parties and business partners; and for other purposes related to the operation of our business or your application for or employment with us.
To Ensure the Security of the Services. We may process your personal information as necessary or appropriate to protect the rights, property, security, and safety of our employees, applicants, and customers, our information systems, and the public. Keeping you safe requires us to process your personal information, such as your device information, activity information, and other relevant information. We use such information to combat spam, malware, malicious activities or security risks; improve and enforce our security measures; and to monitor and verify your identity so that unauthorized users do not gain access to your information.
To Maintain Legal and Regulatory Compliance. Our business is subject to certain laws and regulations which may require us to process your personal information. We may also use your personal information to respond to law enforcement requests, as required by applicable law, court order, or governmental regulations, and for other lawful processes or public safety purposes.
Transactionsi. Only if you are hired by us, we may use your personal information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
4. Disclosure of Your information
We may disclose or have disclosed the categories of personal information identified in the section above titled The Information We Collect to service providers and contractors who provide us services that include, without limitation, recruiting, payroll processing, benefits administration, background check administration, data analytics, website administration and hosting, data storage, hosting, and other technical services, and professional services (e.g., legal advice, audits, consultancy).
We may also disclose your personal information: (a) if such information is subpoenaed; (b) to comply with federal, state, or local laws; (c) to comply with a civil, criminal, or regulatory inquiry, investigation, or summons by federal, state, or local authorities; (d) to cooperate with law enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws; (e) to conduct an investigation, assert or defend a legal claim, (f) in connection with a sale or merger with a third-party or if we are acquired by a third-party (collectively, “M&A Transactions”) (including where we share your personal information in connection with the due diligence process associated with a potential M&A Transaction); (g) if we are the subject of bankruptcy proceedings; and/or (h) when we deem it necessary or appropriate.
5. LINKS TO THIRD-PARTY SITES AND THIRD-PARTY INTEGRATIONS
We may provide links to websites or resources outside of our Site for your informational purposes only. We may also provide links to third-party integrations. Third party integrations are websites or platforms that synchronize with our Site to provide you with additional functionality, tools, or services such as maps, sending requested information, etc.
You acknowledge and agree we are not responsible for the availability of third-party sites, resources, or integrations and do not endorse and are not responsible or liable for any content, advertising, goods, services or other materials on, available through, or provided by such sites, resources, or integrations. We are not responsible for the privacy or other practices of such sites and cannot guarantee the security of personal information that you provide, or that is collected by, such sites. We encourage you to review the privacy policies and terms and conditions on those linked sites.
6. SECURITY
We take precautions to protect data and information under our control from misuse, loss or alteration. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information, to maintain data accuracy, to ensure the appropriate use of information, and otherwise safeguard your personal information. However, no system for safeguarding personal or other information is 100% secure and, although we have taken steps to protect your personal information from being intercepted, accessed, used or disclosed by unauthorized persons, we cannot fully eliminate security risks associated with personal information.
Please recognize that protecting your personal information is also your responsibility. We ask you to be responsible for safeguarding the password, security questions and answers, and other authentication information you use to access our Site.
We retain your personal information for as long as necessary to process your application for or manage your employment with the Company and in accordance with our data retention schedule. We may retain your personal information for longer if it is necessary to comply with our legal or reporting obligations, resolve disputes, enforce contracts, address other legitimate business needs, or as permitted or required by applicable law. We may also retain your personal information in a deidentified or aggregated form so that it can no longer be associated with you. To determine the appropriate retention period for your personal information, we consider various factors, such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we collect or process your personal information; and applicable legal requirements.
8. CHILDREN’S PRIVACY
Our Site is not intended for use by children under 16. Accordingly, we do not knowingly solicit or collect personal information from anyone we know to be under 16 years of age. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from children without verification of parental consent, we will take appropriate steps to remove such information from our servers.
9. APPLICABLE LAW
This Policy is governed by the internal substantive laws of the state of Georgia without regard to its conflict of laws principles. Jurisdiction for any claims arising under or out of this Privacy Policy shall lie exclusively with the state and federal courts within Georgia. If any provision of this Policy is found to be invalid by a court having competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Policy, which shall remain in full force and effect.
10. INTERNATIONAL TRANSFERS
When you access or use our Site, or otherwise provide us personal information, we may transfer your personal information to other countries where we conduct business. Such countries may be located outside of the country or jurisdiction where you are located and may have data protection laws that are less protective of personal information. If you do not want your information transferred to or processed or maintained outside of the country or jurisdiction where you are located, you should not use the Site or provide us your information.
11. CALIFORNIA RESIDENTS
This section applies only to California residents. It supplements and amends the information contained in the Policy with respect to California residents. The other provisions of the Policy continue to apply, except as modified in this California section.
Your Rights
If you are a California resident, you may have certain rights related to your personal information, subject to certain exceptions. Specifically:
Right to Know. You have the right to request that we disclose the following to you upon receipt of your verifiable consumer request:
- The categories of personal information we have collected about you
- The categories of sources from which we collected that information
- The business or commercial purposes for collecting, selling, or sharing that information
- The categories of personal information we sold or disclosed for a business purpose
- The categories of third parties to whom we sold or disclosed that information
- The specific pieces of personal information we collected about you
Right to Delete. You have the right to request that we delete your personal information from our records, subject to certain exceptions. Upon receipt of a verifiable consumer request, and as required by the CCPA, we will delete and direct any service providers to delete your personal information.
We are not required to comply with deletion requests if we, or our service providers or contractors, need the subject information in order to:
- Complete the transaction for which the personal information was collected, provide a good or service requested by you or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between us and you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.
- Debug to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
- Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us and compatible with the context in which you provided the information to us.
- Comply with a legal obligation.
- Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.
Right to Correct. You have the right, subject to certain limitations, to request that we correct any inaccurate personal information we maintain about you. Upon receipt of a verifiable consumer request, and as required by the CCPA, we will take appropriate steps to respond to your request.
Right to Opt-Out of Selling or Sharing. You have the right, subject to certain limitations, to opt-out of having your personal information sold or shared. However, we do not sell or share your personal information, as those terms are defined in the CCPA, and do not have actual knowledge that we have sold personal information of minors under age 16.
Right to Limit Use or Disclosure of Sensitive Personal Information. You have the right, subject to certain exceptions, to request that we limit the use and disclosure of your sensitive personal information, as that term is defined in the CCPA. Upon receipt of a verifiable consumer request, and as required by the CCPA, we will take appropriate steps to respond to your request.
Right Against Retaliation. You have the right not to be retaliated against for exercising any of the rights described in this section.
Shine the Light. California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by us to third parties for the third parties’ direct marketing purposes. Such requests must be submitted to us in accordance with the instructions in the Contact Us section of this Policy. Please mention when contacting us that you are making a “California Shine the Light” inquiry. Within 30 days of receiving such a request, we will provide a list of the categories of personal information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties. This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than in accordance with the instructions specified in this paragraph.
Eraser Law. If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California law permits you to request and obtain removal of content or information you have publicly posted. You may submit your request using the contact information at the end of this Policy. Please be aware that such request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.
Submitting Consumer Rights Requests
To submit a consumer rights request, please contact us at toll free (310) 319-1850 or legal@fatbrands.com
Verification. We reserve the right to only respond to verifiable consumer requests. A verifiable consumer request is one made by:
- the consumer who is the subject of the request,
- a consumer on behalf of the consumer’s minor child, or
- a natural person or business entity authorized to act on behalf of a consumer.
To verify your identity, we may ask you to verify personal information we already have on file for you. If we cannot verify your identity from the information we have on file, we may request additional information from you, which we will only use to verify your identity, and for security or fraud-prevention purposes. Making a verifiable consumer request does not require you to create an account with us. Additionally, you will need to describe your request with sufficient detail to allow us to review, understand, assess, and respond.
Authorized Agents. You may authorize a natural person or business entity to act on your behalf with respect to your rights under this section. Unless you have provided the authorized agent with a qualifying power of attorney, you must provide your authorized agent written permission, signed by you, to act on your behalf and verify the authorized agent’s identity with us. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization.
We may not be able to respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.
Our Response. We reserve the right to charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will attempt to notify you as to why we made that decision and provide a cost estimate before completing your request. We will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of receipt, but we may require an extension of up to forty-five (45) additional calendar days to respond and we will notify you of the need for the extension.
If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically. Any disclosures we provide will only cover the 12-month period preceding the receipt of your verifiable consumer request. With respect to personal information collected on and after January 1, 2022, and to the extent expressly permitted by applicable law, you may request that such disclosures cover a period beyond the 12 months referenced above, provided doing so would not be impossible or require a disproportionate effort by us. The response we provide will also explain the reasons we cannot comply with a request, if applicable. To the extent permitted by the CCPA, we will respond to no more than two requests during any 12-month period.
12. NEVADA RESIDENTS
Under Nevada law, Nevada residents may opt out of the sale of certain “covered information” collected by operators of websites or online services. We currently do not sell covered information, as “sale” is defined by such law, and do not have plans to do so. In accordance with Nevada law, you may submit to us a verified request instructing us not to sell your covered information. Such requests can be submitted in accordance with the instructions provided in the Contact Us section of this Policy.
13. CONTACT US
If you have questions or comments about this Privacy Policy or this Site, you may contact us at legal@fatbrands.com