California Privacy Rights

Roti Holdings, LLC

CALIFORNIA PRIVACY POLICY

Last Updated: April 30, 2026

Your privacy is important to us at Roti Holdings, LLC, and its affiliates and subsidiaries, including, but not limited to, Roti Restaurant Group, LLC, Roti Modern Franchising, LLC, Roti IP, LLC, and Roti Restaurant Group UK Ltd. (collectively, “Roti,” “we,” “us,” or “our”), and we are committed to safeguarding, preserving, and respecting your privacy rights. If you are a California resident, you have certain rights with respect to the collection, use, transfer, and processing of your personal information, as defined by the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act (“CRPA”) and implementing regulations. This Notice is limited to the data practices of Company in California. In the event of a conflict between any other Roti policy, statement or notice and this California Privacy Policy (“Policy”), this Policy will prevail as to California Consumers and their rights under the CCPA.  Terms defined in the CCPA that are used in this Policy shall have the same meaning as in the CCPA.

This Policy describes how we collect, use, share, disclose, retain, and secure the personal information we gather about you through the Platforms (as defined in section 6 (Notice of Financial Incentive), our websites and those of our affiliates including:  https://www.roti.com (collectively, the “Site”), when you interact with us as a customer, or otherwise (collectively, the “Services”). This Policy only applies to personal information as defined by the CCPA, and it does not apply to information exempted from or outside the scope of the CCPA. If you are a job applicant, please see our Applicant Privacy Policy available on Roti’s Applicant Tracking System via ADP.

We reserve the right to limit these rights where permitted under applicable law, including where your identity cannot be reasonably verified or to the extent your rights adversely affect the rights and freedoms of others. 

1.     WHAT INFORMATION DO WE COLLECT?

The table below describes categories of personal information and our collection and retention of personal information within those categories in the previous 12 months. This notice will be updated annually, and our current privacy notices at the point of collection and general privacy statements may reflect more current practices.

2.     SOURCES FROM WHICH PERSONAL INFORMATION IS COLLECTED

We collect your personal information directly from you, from your interaction with the Site, from publicly available sources, and from third parties which collect the personal information directly from you.  

3.     BUSINESS OR COMMERCIAL PURPOSES FOR WHICH PERSONAL INFORMATION IS COLLECTED

Your personal information is used for the following purposes:

·      Processing Interactions and Transactions

·      Managing Interactions and Transactions

·      Presenting our Services, the Site and their contents in a suitable and effective manner for you and your device;

·      Complying with the law;

·      Security & Integrity, including (without limitation) protecting against security incidents and fraudulent, malicious, illegal, or wrongful conduct

·      Contacting  you to provide you with information or services that you request from us;

·      Advertising opportunities, services, or special events that we think may be of interest to you;

·      Providing customer support, troubleshooting account issues, manage accounts, and respond to requests, questions, or comments;

·      Other debugging or quality assurance activities;

·      Carrying out our obligations and enforce our rights arising from any contracts, including enabling our service providers and business partners (and their service providers and/or subcontractors) to provide services to us; and

·      Notifying you about any additions, upgrades, or changes in our services and;

·      Short-term, transient use, including non-personalized advertising.

4.     THIRD PARTIES WITH WHOM PERSONAL INFORMATION IS DISCLOSED, SHARED, OR SOLD

Roti does not sell personal information for monetary consideration. As is common among businesses that operate internet websites, we may disclose the categories of personal information described in this section in a way that could be deemed a “sale” or “sharing” of data for cross-context behavioral advertising under California law to third parties including advertising companies and social networks.  We do not “sell” personal information of individuals we know to be under the age of 16, or share the personal information of individuals we know to be under the age of 16 for cross-context-behavioral advertising.

In the preceding 12 months, we have disclosed the following personal information about consumers for business purposes:

We disclose personal information in categories A (identifiers), B (personal), D (commercial), F (internet), G (geolocation), and K (inferences) with service providers.

We disclose content that you post on our social media platforms (e.g., if a you “comment” on a story) with other consumers. Such posts may include personal information in categories A (identifiers) and B (personal), but the content depends on the individual posts.

We may share all of our information, including your personal information, with our subsidiaries and affiliates in connection with providing the Services to you or otherwise in connection with business operations.

In the preceding 12 months, we have shared for cross-contextual behavioral advertising the following the personal information in categories A (identifiers), B (personal), D (commercial), F (internet), G (geolocation), and K (inferences).

In the preceding twelve (12) months, we have not sold the personal information of any consumer for monetary consideration. However, our use of cookies and other tracking technologies may be considered a sale of personal information under the CCPA. Some of those cookies or pixels may collect personal information so that it can be used in connection with the marketing efforts of third parties.  In those instances, your personal information may be used for third parties to serve unsolicited information, services, or products to you. Categories of personal information that we have sold under the CCPA include categories A (identifiers), B (personal), D (commercial), F (internet), G (geolocation), and K (inferences). Categories of third parties to whom personal information is sold under the CCPA include data analytics providers and advertising and marketing providers.

You can opt out of our cookies and other tracking technologies used for analytics and advertising service providers by clicking the Your Privacy Choices link located at the bottom of the Site. Please note that your use of our website will still be tracked by Roti and its service providers for other permitted business purposes.

We do not have actual knowledge that we sell or share the personal information of consumers under eighteen (18) years of age.

5.     INDIVIDUAL RIGHTS

A.   Right to Know About Personal Information Collected, Disclosed, Shared, or Sold

You have the right to request that we disclose the personal information we collect, use, and disclose about you to third parties. There are two types of Rights to Know requests that you can make:

     I.         Right to Know (Abbreviated Request): If you make a Right to Know (Abbreviated Request), you will receive the following information about you:

• Categories of personal information collected, sold, or shared;
• Categories of sources from which personal information is collected;
• Categories of third parties to whom the information is sold, shared or disclosed;
• Business or commercial purpose for collecting, sharing, or selling personal information;
• Categories of personal information disclosed for a business purpose and categories of persons to whom it was disclosed for a business purpose.

   II.         Right to Know (Specific Pieces of Information Request): If you make a Right to Know (Specific Pieces of Information Request), you will receive the following information about you:

• Specific pieces of personal information collected about you.

This information will be provided to you free of charge, unless we determine that your request is manifestly unfounded or excessive. You may request this information twice in a 12-month period.

There are certain exceptions to a consumer’s Right to Know. We will state in our response if an exception applies.

B.    Right of Deletion

You have the right to request that we and our service providers delete any personal information about your which we have collected from you upon receipt of a verifiable request.  This right is subject to certain exceptions.  We will state in our response if an exception applies.

C.   Right to Opt-Out of the Sale or Sharing of Personal Information

You have the right to opt-out of the sale or sharing of your personal information by a business subject to certain laws and regulations. 

Please note that opt-out choices may be stored via cookies.  If you clear cookies, if your browser blocks cookies, or if you view the page from a different browser or device, your opt-out choice may no longer be logged or recognized. 

For more information, please visit our Your Privacy Choices page found here.

D.   Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising the privacy rights conferred by California law.  We will not discriminate against you because you exercised any of your privacy rights, including, but not limited to, by: denying goods or services to you; charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; providing a different level of quality of goods or services to you; or suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.  We will also not retaliate against any employee, applicant for employment, or independent contractor for exercising their rights under the CCPA.

E.    Right of Correction

If we maintain inaccurate personal information about you, then you have the right to request that we correct the inaccurate personal information.

F.    Right to Limit Use and Disclosure of Sensitive Personal Information

Subject to certain exceptions provided by California law, if we process Sensitive Personal information about you, then you have the right to request that we limit the use of that information.  At this time, the only sensitive personal information collected is done so for the purpose(s)s specifically authorized by California law and in a manner that is necessary and proportionate for those purposes.

G.   Submitting Requests

You can submit your request here or by calling us toll-free phone at 678-272-4247. You may also exercise these rights via an authorized agent who meets the agency requirements of the CCPA.

H.   Verifying Requests

We provide California Consumers the privacy rights described in this policy. As required by the CCPA, any request you submit to us is subject to a verification process. To verify your request, you must provide your name, email, and state of residence, along with any other information we may require to verify your identity or your request. We may not fulfill your CCPA request unless you have provided sufficient information for us to appropriately verify you and your request. Please follow the instructions at here and respond to any follow up inquires we may make.

I.     Authorized Agents

You may choose a person or a business that you authorize to act on your behalf to submit your requests (“Authorized Agent”).  If you choose to use an Authorized Agent, we require that you provide the Authorized Agent with written permission to allow them to submit your request and that you verify your identity directly with us.  Failure to do so may result in Roti denying your request.

6.     NOTICE OF FINANCIAL INCENTIVE

We offer our Roti Perks loyalty rewards and customer engagement program (“Loyalty Program”) made available through https://rewards.thanx.com/roti and/or www.order.thanx.com/roti (collectively, the “Rewards Site”) and as an application for mobile devices (the “Roti App”) (collectively, the “Platforms”). When you use our Loyalty Program, you will be eligible to participate in certain promotional programs and receive rewards, such as special offers and discounts. In the course of administering our Loyalty Program, we will collect Identifiers, Personal Information, Commercial Information, and Inferences Drawn of the Consumer.

To offer the Loyalty Program, Roti has engaged Thanx, Inc. (“Thanx”) as a service provider to operate the Platforms. Because the Platforms are operated by Thanx, any information you provide via the Platforms, or that Roti inputs to the Platforms, may be hosted and stored by Thanx on Roti’s behalf. Thanx uses this information to provide the Platforms under contract with Roti and in accordance with Roti’s instructions and applicable laws. Thanx may also rely on other third-party service providers that help it operate the Platforms, such as hosting, information technology, support, email and text message delivery, and website analytics services. Your personal information may also be disclosed in connection with a merger, acquisition, reorganization or sale of all or a portion of Thanx's assets or in the event of bankruptcy.

To opt-in to the Loyalty Program, you can sign up following the steps here. You have the right to withdraw from the Loyalty Program at any time. To do so, please contact Roti by mail at: 10 Glenlake Parkway, North Tower, Suite 300, Atlanta, GA 30328, or by email at help@roti.com.

We offer our Loyalty Program, among other things, to enhance our relationship with you so you can enjoy more of our products/services at a lower price. The value to our business of any individual consumer’s data is dependent on a number of factors, including, for example, whether and to what extent you take advantage of any offerings, whether and to what extent you opt out of any offerings, and whether we are able to enhance the data through our efforts described in this Policy. We do not calculate the value of consumer data in our accounting statements. We make this good faith estimate for California residents. To the extent we create overall value from our programs to our business that could be directly or reasonably related to the value of customer data, the method for calculating the value would include: (1) costs related to maintaining the program including but not limited to IT infrastructure, delivery of offers, and skilled marketing teams with the appropriate knowledge to enhance customer data; (2) whether the sales generated by the program exceeds the cost to us of offering the program including value of discounts to customer; and (3) value of the insights we are able to create based upon aggregate data.

You may find more information regarding the legal terms and conditions for the Roti Loyalty Program in our Terms of Use found here.

7.     CONTACT US

If you have any questions about this Privacy Policy, please contact us by email at privacy@roti.com or via phone at 678-272-4247.

8.     PRIVACY REQUEST METRICS

For 2025, we received and responded to California consumer privacy requests as detailed in the following table:

[1] Categories of personal information are as defined in Cal. Civ. Code. § 1798.140(v).