Bon Appetit Privacy Notice

Effective as of 14-Jan-2021

This Privacy Notice (“Notice”) explains our privacy practices and how Bon Appetit (“Bon Appetit”, “we”, “us” or “our”) collects, uses and shares your personal information in connection with your use of our mobile application (collectively, the “App”) that links to this Privacy Notice. This Notice also describes choices that may be available to you regarding use, access, deletion and correction of your personal information.

Please read this Privacy Notice carefully. By using the App, you acknowledge that you have read and understood this Privacy Notice. This Privacy Notice is not, however, a contract and does not create any legal rights or obligations.

Table of Contents

• How we gather personal information

• Personal information we collect

• How we use your personal information

• Lawful basis for processing personal information (EEA and UK only)

• How we share your personal information

• Your privacy rights

• Other sites and services

• Security practices

• Data Retention

• International data transfers

• Children’s Privacy

• Updates to this Notice

• Contact Us

How we gather personal information

We may collect personal information from or about you in a variety of ways:

• We collect your personal information when you actively provide it to us. For example, users directly give us personal information when signing up for an account, communicating with Bon Appetit, or modifying an account profile.

• We may receive personal information about you from a business or commercial partner. For example, we may receive personal information from third-party service providers that you have linked to your use of the App (including single-sign-on services), or publicly available sources.

Personal information we collect

As used in this Privacy Notice, “personal information” or “personal data” means any information or data relating to an identified or identifiable natural person or household that we process in connection with our App; an identifiable natural person or household is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person or household.

Information you provide to us:

Personal information you may provide to us through the App includes:

• Contact data, such as your first and last name, and email.

• Account data, such as your username and password that you set to establish an online account with us, and other information you include in your account profile.

• Communications that we exchange when you communicate with us, such as when you request support, or contact us with questions or feedback.

• Content such images or other content you upload to or provide through the App.

• Other information that we may collect which is not specifically listed here, which we will use as described in this Privacy Notice or as otherwise disclosed at the time of collection.

Information we automatically collect when you use our App:

We may automatically log information about you, including device data, such as your IP address and general location information such as geographic area.

Cookies and similar technologies:

Some of our automatic data collection on the App is facilitated by software development kits, or SDKs, which are used to incorporate third party computer code into our App that allows the third party service providers to collect data directly from it for a variety of purposes, including to add features or functionality to our app.

How we use your personal information

App delivery. We may use your personal information to:

• provide, operate and improve the App;

• facilitate your authentication to the App by logging into a third party platform, such as Google or Apple;

• enable security features of the App, such as by remembering devices from which you have previously logged in;

• communicate with you about the App, including by sending you announcements, updates, security alerts, and support and administrative messages;

• provide support and maintenance for the App; and

• to respond to your requests, questions and feedback

Research and development. We may use your personal information for research and development purposes, including to analyze and improve the App. As part of these activities, we may create aggregated, de-identified or other anonymous data from personal information we collect. We make personal information into anonymous data by removing information that makes the data personally identifiable to you.

Compliance and protection. We may use your personal information to:

• comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

• protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); and

• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

For other purposes. We may also use your personal information for other purposes described in this Privacy Notice or at the time we collect the information.

Lawful basis for processing personal information (EEA and UK only)

When we collect personal information from you in connection with offering the App within the European Economic Area (EEA) and the United Kingdom (UK), our lawful basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

We will normally collect personal information from you in order for you to use the App, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect the personal information in question or we may process your personal information where we have your consent to do so.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the "Contact Us" section below.

How we share your personal information

We will not rent or sell personal information about you. We may share your personal information with the following parties and as otherwise described in this Privacy Notice or at the time of collection:

Third party platforms. Other third party platforms that you connect to the App and where you authorize us to share your information with them (such as when you use options to access the App by logging into the third party platform such as Google or Apple).

Authorities and others. Law enforcement, government authorities, and private parties, when we believe in good faith it is necessary or appropriate for the compliance and operations purposes described above.

For other purposes. We may also share your personal information for other purposes such as authorized vendors who operate, deliver, improve and customize our App, or as described in this Privacy Notice or with your consent.

Your Privacy Rights

Access or update your information. You may access or update your account information by accessing the account settings on your App.

Your Privacy Rights as a data subject protected by EEA/UK law or as a California Resident

If you are a person located in the EEA/UK or if you are a California resident, you may have broader rights to access and delete your personal information, to object to or restrict processing of your personal information, to correct your personal information, or request portability of your personal information.

• Access: You can request more information about the personal data we hold about you. You can request a copy of the personal data.

• Rectification: If you believe that any personal data we are holding about you is incorrect or incomplete, you can request that we correct or supplement the data. You can also correct some of this information directly by logging into your App account settings. Please contact us as soon as possible if you notice any inaccuracy or incompleteness.

• Objection: You can let us know that you object to the collection or use of your personal data for certain purposes.

• Erasure: You can request that we erase some or all of your personal data from our systems. You can also delete some of this information directly by logging into your App account settings.

• Restriction of Processing: You can ask us to restrict further processing of your personal data. (This just means you can ask us to stop using it for what we have been using it for.) This may mean that we have to delete your account.

• Portability: You can ask for a copy of your personal data in a machine-readable format. You can also request that we transmit the data to someone else where it’s technically possible.

• Withdrawal of Consent: If you have consented to our use of personal data for a specific purpose, you have the right to change your mind at any time. Any such decision will not affect any processing that has already occurred nor will it affect processing of your personal information conducted in reliance of lawful processing grounds other than consent. Withdrawing your consent may mean your access to the App will be limited or suspended, and your account may be terminated, as applicable. Where you withdraw your consent, but we are using your information because we have a legitimate interest in doing so, or we have different legal basis for using your information, we may continue to process your information, subject to your rights to access and control your information.

• Right to File Complaint: You have the right to lodge a complaint about our practices with respect to your personal data with the supervisory authority of an EU Member State, or the California Attorney General.

Additional Privacy Rights as a California Resident

If you are a California resident and use our App you may have the right to receive a free, yearly accounting of:

• Information identifying each third-party company to whom we may have disclosed, within the past year, personal information pertaining to you for our own direct marketing purposes; and

• A description of the categories of personal information disclosed.

You may have the right to know more about personal information that we have collected, disclosed, or sold, including:

• The categories of personal information that we have collected or shared about you in the preceding 12 months,

• The categories of sources from which we have collected that information in the preceding 12 months

• The commercial or business reason(s) we have collected or shared that information,

• The categories of third parties with whom we have shared or to whom we have sold that information in the preceding 12 months, and

• Pursuant to a verifiable request, the specific pieces of information that we have collected about you.

Depending on the nature of your request, we may need additional information to verify your identity.

To make a request, please submit a ticket through our Help Center within the App.

Do Not Track. We currently do not respond to “Do Not Track” or similar signals.

Other sites and services

The App may contain links to other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or other online services operated by third parties, and we are not responsible for their actions. Other websites and online services follow different rules regarding the collection, use and sharing of your personal information. We encourage you to read the privacy policies of the other websites and online services you use.

Security practices

We employ a number of technical and organizational safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

Data Retention

We will retain your personal information for no longer than is necessary to fulfill the purposes for which the information was originally collected unless a longer retention period is required or permitted by law, for legal, or other legitimate and lawful business purposes.

Where we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it.

International data transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. The privacy laws in these regions may not be as protective as those in your state, province, or country.

Children’s Privacy

Our App is not intended for use by children under 16 years of age. If we learn that we have collected personal information from a child under 16 without the consent of the child’s parent or guardian as required by law, we will delete it.

Updates to this Privacy Notice

We may modify this Privacy Notice at any time. If we make material changes to this Privacy Notice, we will notify you by updating the effective date of this Privacy Notice and posting the modified Privacy Notice to the App.

Any modifications to this Privacy Notice will be effective when posted (or as otherwise indicated at the time of posting). In all cases, your continued use of the App after the posting of any modified Privacy Notice indicates your acceptance of the modified Privacy Notice.

Contact Us

If you have any questions, comments or concerns about this Privacy Notice, please submit a ticket through our Help Center within the App.