Privacy Policy

Welcome to Chuy's ("we," "us," "our," or the "Company"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website mexican-chuys.rest, place orders, interact with our services, or otherwise engage with us in connection with our food and restaurant business. Please read this policy carefully. If you disagree with its terms, please discontinue use of our website and services immediately.

This Privacy Policy is designed to comply with applicable United States federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission Act (FTC Act), and other applicable consumer protection regulations. By using our website or services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

1. Who We Are

Chuy's is a food and restaurant business operating in the United States. We operate the website mexican-chuys.rest and provide food-related services including online ordering, reservations, catering information, and customer support.

For all privacy-related questions, requests, or complaints, please contact us at [email protected].

2. Information We Collect

We collect various types of information in connection with your use of our website and services. The categories of personal information we collect include, but are not limited to, the following:

2.1 Personal Information You Provide Directly

When you interact with us — for example, by filling out a contact form, creating an account, placing an online order, signing up for our newsletter, or contacting customer support — we may collect:

• Identity Data: Your first and last name, username, or similar identifiers.
• Contact Data: Your email address, telephone number, billing address, delivery address, and other similar contact information.
• Account Data: Your login credentials including username and password (stored in encrypted form).
• Order and Transaction Data: Details of food orders you place through our website, including order history, special dietary preferences or allergy information you voluntarily disclose, payment method type, and transaction records.
• Payment Data: Credit or debit card details and other payment information. Note that full payment card numbers are processed by our third-party payment processors and are not stored on our servers.
• Communication Data: Any messages, feedback, reviews, or inquiries you send to us through our website, email, or customer service channels.
• Marketing Preferences: Your preferences for receiving marketing and promotional communications from us.

2.2 Information We Collect Automatically

When you visit our website, we automatically collect certain technical and usage data, including:

• Usage Data: Pages you visit, links you click, time spent on pages, the referring URL, and navigation paths through our website.
• Device Information: Your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), device identifiers, screen resolution, and language settings.
• Log Data: Server log files that record your interactions with our website, including error logs and access timestamps.
• Location Data: General geographic location inferred from your IP address (such as city or region). We do not collect precise GPS-based location unless you explicitly grant permission.
• Cookie and Tracking Data: Information collected through cookies, web beacons, pixel tags, and similar tracking technologies. Please see Section 7 (Cookies and Tracking Technologies) for more information.

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Social Media Platforms: If you connect your social media account to our website or interact with our social media pages, we may receive certain profile information from those platforms.
• Analytics Providers: Third-party analytics services that provide us with aggregated or de-identified data about how users interact with our website.
• Advertising Partners: Information about your interests and browsing behavior from our advertising partners to help us deliver more relevant promotional content.
• Business Partners: Information shared by our delivery partners, third-party ordering platforms, or other vendors with whom you interact in connection with our services.

2.4 Sensitive Personal Information

In limited circumstances, we may collect sensitive personal information, such as dietary restrictions or food allergies that you voluntarily provide when placing orders. We collect this information solely for the purpose of fulfilling your order and ensuring your safety. We do not use sensitive personal information for purposes beyond those disclosed at the time of collection without your explicit consent.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Managing Our Services

• Processing and fulfilling your food orders and managing your account.
• Sending you order confirmations, receipts, and updates about your order status.
• Managing reservations and catering requests.
• Providing customer service and responding to your inquiries or complaints.
• Facilitating payment processing through our third-party payment processors.

3.2 Improving Our Services

• Analyzing usage data and trends to understand how our website is used and to improve its functionality and performance.
• Conducting internal research, testing, and development to enhance our menu offerings, website features, and overall user experience.
• Diagnosing technical problems and fixing bugs on our website.

3.3 Marketing and Promotional Communications

• Sending you newsletters, promotions, special offers, and information about new menu items or events — but only where you have consented to receive such communications or where we have a legitimate interest to do so under applicable law.
• Personalizing your experience on our website by showing you content and offers most relevant to your interests.
• Running targeted advertising campaigns through third-party advertising networks based on your interests and browsing behavior (subject to your preferences and applicable opt-out rights).

3.4 Legal Compliance and Safety

• Complying with applicable federal and state laws, regulations, and legal obligations.
• Responding to lawful requests from governmental and regulatory authorities.
• Detecting, preventing, and addressing fraud, security incidents, and other potentially prohibited or illegal activities.
• Enforcing our Terms of Service and other agreements.
• Protecting the rights, property, or safety of Chuy's, our customers, employees, or others.

3.5 Business Operations

• Managing our business operations, including accounting, auditing, and record-keeping.
• Carrying out corporate transactions such as mergers, acquisitions, or restructuring, where your data may be transferred to a third party.

4. Legal Basis for Processing

We process your personal information on the following legal grounds, as applicable under United States federal and state law:

• Contractual Necessity: Processing is necessary to fulfill a contract with you, such as processing and delivering your food order.
• Consent: Where you have given us clear consent to process your personal information for a specific purpose, such as receiving marketing emails. You may withdraw consent at any time.
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. For example, we use data analytics to improve our services.
• Legal Obligation: Processing is necessary to comply with a legal obligation to which we are subject.

5. Sharing Your Information with Third Parties

We do not sell your personal information to third parties. However, we may share your information in the following circumstances:

5.1 Service Providers

We share your information with trusted third-party vendors and service providers who perform services on our behalf. These may include:

• Payment Processors: Companies that process payments securely on our behalf.
• Delivery and Logistics Partners: Third-party delivery services that fulfill your food orders.
• IT and Hosting Providers: Cloud hosting, website maintenance, and cybersecurity services.
• Analytics Providers: Services such as Google Analytics that help us understand website traffic and user behavior.
• Email and Marketing Platforms: Platforms that help us send promotional emails and manage marketing campaigns.
• Customer Support Tools: Software platforms that help us manage and respond to customer inquiries.

All service providers are required to process your data only on our instructions and in accordance with applicable privacy laws.

5.2 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our website if such a transfer occurs and if your information will become subject to a different privacy policy.

5.3 Legal Requirements

We may disclose your personal information if required to do so by law or in response to valid legal processes, including subpoenas, court orders, or government requests. We may also disclose information to protect the rights and safety of Chuy's, our employees, customers, or the public.

5.4 Aggregated or De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes.

6. Data Security

We take the security of your personal information seriously and implement a variety of technical, administrative, and physical safeguards designed to protect your data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• Encryption: We use Secure Socket Layer (SSL) / Transport Layer Security (TLS) encryption to protect data transmitted between your browser and our servers.
• Access Controls: Access to personal information is restricted to authorized personnel on a need-to-know basis. All employees with access to personal data are subject to confidentiality obligations.
• Password Security: User account passwords are stored using industry-standard hashing algorithms.
• Secure Payment Processing: Payment card information is processed by PCI-DSS compliant third-party payment processors and is not stored on our servers.
• Regular Security Assessments: We conduct periodic reviews of our security practices and systems to identify and remediate potential vulnerabilities.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and relevant authorities as required by applicable law in the event of a data breach.

7. Cookies and Tracking Technologies

Our website uses cookies, web beacons, pixel tags, and similar tracking technologies to enhance your browsing experience, analyze website traffic, and deliver personalized content and advertising.

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function properly, such as session management and security features. These cannot be disabled.
• Performance and Analytics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously (e.g., Google Analytics).
• Functionality Cookies: Remember your preferences, such as saved items in your cart or your preferred language.
• Targeting and Advertising Cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns.

7.2 Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of our website. You may also opt out of interest-based advertising by visiting the Digital Advertising Alliance's opt-out page or the Network Advertising Initiative's opt-out page.

For more detailed information about our use of cookies, please refer to our Cookie Policy, available on our website.

8. Your Privacy Rights

Depending on your state of residence within the United States, you may have specific rights regarding your personal information. We are committed to honoring these rights as required by applicable law.

8.1 Rights Under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

If you are a California resident, you have the following rights:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to Delete: You have the right to request that we delete personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. We do not sell your personal information. However, if we engage in sharing for advertising purposes, you may opt out.
• Right to Limit Use of Sensitive Personal Information: You have the right to request that we limit the use and disclosure of your sensitive personal information to purposes necessary to provide the services you requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, or provide a lower quality of service as a result of exercising your rights.

8.2 General Privacy Rights (All U.S. Residents)

• Right to Access: You may request access to the personal information we hold about you.
• Right to Correction: You may request that we correct any inaccurate or incomplete information we hold about you.
• Right to Deletion: You may request deletion of your personal information, subject to our legal obligations to retain certain data.
• Right to Data Portability: Where technically feasible, you may request that we provide your personal information in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Opt-Out of Marketing: You may opt out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in any email we send you or by contacting us directly.

8.3 How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable consumer request to us by:

• Email: [email protected]

We will respond to your request within 45 days of receipt. If we require more time, we will inform you of the reason and the extension period (up to an additional 45 days) in writing. We may need to verify your identity before processing your request. We will not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

You may designate an authorized agent to submit requests on your behalf. If you use an authorized agent, we may require written proof of authorization and may verify your identity directly.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The criteria we use to determine retention periods include:

After the applicable retention period, we will securely delete or anonymize your personal information. If deletion is not immediately possible (e.g., because your information is stored in backup archives), we will isolate it from further processing and delete it as soon as practicable.

10. Children's Privacy

We are committed to protecting the privacy of children. Our website, online ordering system, and related services are not directed to, and are not intended for use by, individuals under 18 years of age. If you are under 18, please do not use our website or provide us with any personal information.

If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate parental consent, we will take immediate steps to delete such information from our records. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us promptly at [email protected] so that we may take appropriate action.

We comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect, use, or disclose personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

11. International Data Transfers

Chuy's is based in the United States, and your personal information is primarily collected, stored, and processed in the United States. However, some of our third-party service providers (such as analytics or cloud hosting companies) may be located in other countries and may process your data outside of the United States.

If you are accessing our website from outside the United States, please be aware that your information may be transferred to, stored, and processed in a country where data protection laws may differ from those in your country of residence. By using our website and providing us with your personal information, you consent to such transfer, storage, and processing.

We take appropriate steps to ensure that any international transfers of personal data are subject to adequate safeguards, including contractual protections and, where applicable, compliance with applicable transfer frameworks recognized under U.S. law.

12. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, delivery partner sites, or other external services. These third-party sites are not operated by us and have their own privacy policies, which we encourage you to review. We are not responsible for the content, privacy practices, or data handling of any third-party websites or services linked from our website. The inclusion of any link does not imply endorsement by Chuy's of the linked website or its operators.

13. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals websites that you do not want your online activity tracked. Our website does not currently respond to DNT signals, as there is no universally accepted standard for how DNT signals should be interpreted or acted upon. We will continue to monitor developments in this area and update our practices accordingly.

However, you can manage your tracking preferences through our cookie settings and by using the opt-out tools described in Section 7 of this Privacy Policy.

14. California-Specific Disclosures

In addition to the rights described in Section 8, California residents are entitled to the following specific disclosures under the CCPA/CPRA:

14.1 Categories of Personal Information Collected

Over the past 12 months, we have collected the following categories of personal information:

• Identifiers (e.g., name, email address, IP address)
• Commercial information (e.g., order history, transaction records)
• Internet or other electronic network activity information (e.g., browsing history on our website)
• Geolocation data (general location inferred from IP address)
• Inferences drawn from personal information to create a profile about consumer preferences
• Sensitive personal information (dietary restrictions or food allergies — only as voluntarily provided)

14.2 Shine the Light Law

Under California Civil Code Section 1798.83 (the "Shine the Light" law), California residents who have an established business relationship with us may request information about personal information we may have disclosed to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, please contact us at [email protected].

15. How to File a Complaint

If you have concerns about how we handle your personal information and are not satisfied with our response, you have the right to file a complaint with the relevant data protection or consumer protection authority. In the United States, relevant authorities include:

• Federal Trade Commission (FTC): The FTC enforces federal consumer protection and privacy laws, including the FTC Act. You can file a complaint at www.ftc.gov/complaint.
• California Privacy Protection Agency (CPPA): California residents may file complaints regarding violations of the CCPA/CPRA with the California Privacy Protection Agency at cppa.ca.gov.
• Your State Attorney General's Office: Many states have consumer protection divisions within the Attorney General's office that handle privacy-related complaints. We encourage you to contact your state's Attorney General if you believe your privacy rights have been violated.

We strongly encourage you to contact us first at [email protected] before filing a formal complaint so that we can address your concerns directly and promptly.

16. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or for any other reason. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on our website informing you of the changes.
• Where required by applicable law, notify you directly via email or other communication channels.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website or services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please do not hesitate to contact us:

We are committed to resolving any privacy concerns promptly and transparently. Upon receiving your inquiry, we will acknowledge it within 5 business days and provide a substantive response within 30 days, or sooner where required by law.