Effective Date: March 2026
Last Updated: March 2026
This Privacy Policy explains how Papa ERDR, ER Foods, Disrupt Wings and its affiliates, subsidiaries, brands, and franchise support entities (collectively, the “Company,” “we,” “us,” or “our”) collect, use, disclose, retain, and protect personal information. This policy is intended to be brand agnostic and may be adapted for use across a franchise group’s corporate website, brand websites, lead forms, customer service channels, recruiting portals, franchise development pages, and other online and offline touchpoints.
This Privacy Policy should be reviewed and customized by legal counsel before publication, especially if the Company operates in states or countries with specific privacy notice, consent, or consumer-rights requirements.
The Federal Trade Commission states that companies must honor the privacy promises they make and maintain security appropriate to the nature of the data they hold. The California Consumer Privacy Act, as amended by the CPRA, requires covered businesses to provide consumers with notice about collection, use, sharing, sale, and privacy rights.
This Privacy Policy applies to personal information collected by or on behalf of the Company through:
This Privacy Policy does not apply to:
Because franchise systems often include both corporate entities and independently owned franchise locations, data practices may differ depending on which entity interacts with an individual. A franchise group should clearly identify whether data is handled by the franchisor, an affiliate brand, a shared services entity, or an independently owned franchisee.
Depending on how an individual interacts with the Company, the Company may collect the following categories of personal information:
California identifies personal information broadly and recognizes a separate category of sensitive personal information with additional rights related to limiting certain uses and disclosures.
The Company may collect personal information from the following sources:
The Company may use personal information for the following business and commercial purposes:
The FTC advises businesses to collect only what they need, restrict access to sensitive data, and maintain reasonable security for the information they hold.
The Company and its partners may use cookies, pixels, tags, SDKs, session replay tools, and similar technologies to:
Where required by law, the Company will provide notice and obtain consent before using certain non-essential cookies or similar technologies. Users may also be able to control cookies through browser settings, device permissions, cookie preference tools, or legally recognized privacy signals where applicable.
The Company may disclose personal information to the following categories of recipients:
If the Company “sells” or “shares” personal information as those terms are defined by California law, it should expressly describe those practices and provide required opt-out methods.
Because a franchise group may operate through multiple legal entities and independently owned locations, personal information may be shared across the franchise system for lead routing, customer service, local fulfillment, operations support, reporting, training, brand standards, and marketing coordination. Where a local franchisee independently controls how personal information is used, that franchisee may be a separate business responsible for its own privacy practices. This allocation should be described clearly in public-facing notices to reduce confusion.
If the Company is subject to laws that require disclosure of legal bases for processing, personal information may be processed on one or more of the following grounds:
The Company retains personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain business and tax records, comply with legal obligations, resolve disputes, enforce agreements, and support safety, security, and fraud-prevention efforts. Retention periods may vary based on the type of information, the context in which it was collected, and applicable legal requirements.
California requires covered businesses to provide consumers with a fuller description of their privacy practices and rights in their privacy policy.
The Company uses administrative, technical, and physical safeguards designed to protect personal information appropriate to the nature of the information and the risks involved. No security measure is perfect or impenetrable, and the Company cannot guarantee absolute security.
The FTC states that businesses have an obligation to maintain security appropriate in light of the nature of the data they possess, and FTC guidance emphasizes written and risk-appropriate security programs for covered entities.
Depending on where an individual lives, that person may have the right to:
California residents have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive notice at or before collection.
Individuals may opt out of marketing emails by using the unsubscribe link in the message or by contacting the Company. SMS marketing choices may be managed by replying with the instructions provided in the message or by contacting the Company. Even if an individual opts out of marketing, the Company may still send transactional or service-related communications.
The Company’s websites, services, and franchise opportunities are not directed to children under 13 unless expressly stated otherwise. The FTC explains that the Children’s Online Privacy Protection Act gives parents control over information websites collect from children and imposes additional obligations on covered operators.
If the Company knowingly collects personal information from children in circumstances governed by COPPA or similar laws, the Company will provide the required notices and obtain any required parental consent.
Company websites and communications may contain links to third-party sites, tools, plug-ins, or platforms that are not controlled by the Company. The Company is not responsible for the privacy, security, or content practices of those third parties, and individuals should review their privacy policies separately.
If the Company transfers personal information across borders, it will take steps appropriate to applicable law. The FTC notes that businesses participating in the Data Privacy Framework must self-certify and comply with the applicable principles if relying on that mechanism for EU-U.S. data transfers.
The Company may update this Privacy Policy from time to time. When material changes are made, the Company will revise the “Last Updated” date and take any additional steps required by law. Continued use of the relevant services after an updated policy becomes effective is subject to applicable law.