BentoBox Privacy Policy

Last updated: March 10, 2025

This Privacy Policy describes the privacy practices of BentoBox CMS, Inc. (“BentoBox”) when it and its respective subsidiaries and affiliates provides the BentoBox platform to the company whose branding is displayed on the website (“Site”) (the “Restaurant”). References in this Privacy Policy to “we,” “us,” or “our” mean BentoBox. This Privacy Policy does not apply to any websites, mobile applications, other online services that do not link to this policy, or your in-person or telephonic interactions with the Restaurant.

Information Collected

Information collected in connection with your use of the Site may include:

Information you provide, such as:

• Account information, which includes name or other similar identifiers;

• Profile and contact information, such as your first and last name, email address, street address, and phone number, which we may collect when you sign up for or interact with BentoBox services which may include creating a diner account or making reservations with Restaurants.

• Transaction and reservation information, such as information about your payments and other details of meals, products, or services you have purchased from the Restaurant, and reservations you have made.

• Payment details, such as payment card information, and billing details, which the payment processor for the Restaurant collects. We also let you save your payment information to make it easier for you to make purchases at restaurants that operate on our platform. If you file a dispute with the financial institution which issued your credit card, we may receive that information in connection with assisting the Restaurant’s response and as otherwise needed to handle the dispute.

• Usage data, which includes information about how you use our Services and sites;

• Feedback or correspondence, such as information you provide when you contact us with questions, reviews, feedback, or otherwise correspond with us online.

• Your marketing preferences, such as whether you wish to receive marketing communications or newsletters.

• Information about your participation in a Restaurant’s loyalty program, if offered and if you choose to participate.

• Other information that you provide to us voluntarily, or which reflects our offline interactions with you, such as your birthdate, interests, preferences, or restrictions.

Cookies and Other Information Collected by Automated Means. We, our service providers, and other third parties may automatically collect information about you, your computer or mobile device, and activity occurring on or through the Site. These parties may collect this type of information over time and across third-party websites and may use cookies, web beacons, pixels, and other technologies to collect this information. The information may include:

• Information about your device’s hardware, such as model and screen resolution

• Information about the software on your device, such as your browser type

• Unique identifiers associated with your device, such as device identifier

• Information about the network to which you are connected and inferences we may draw from it, such as your IP address and general location information such as city, state, or geographic area

• Information about your use of and actions on the Site, such as pages you viewed, how long you spent on a page, navigation paths between pages, information about your activity on a page, links you click, access times, and length of access; and the website that referred you to the Site, if applicable

• Information about your interaction with our emails, such as whether you opened our email and how long you had it open.

• Information that you may provide via the Clover point of sale device. We may collect information from you when you provide it to us through a point-of-sale device, such as a Clover device.

• Information that you may provide to Restaurants. We may receive information about you from our Restaurant clients, for example when they import an address book.

• Information that we collect from private and publicly accessible sources. We and our service providers may collect information about individuals that is publicly available, including by searching publicly accessible government lists of restricted or sanctioned persons, public records databases, and by searching media and the internet. We and or our third-party verification providers may also collect information from private or commercially available sources, such as by requesting reports or information from credit reference and fraud prevention agencies, to the extent permitted under applicable law. We may also maintain pages for our company and our products and services on a variety of third-party platforms, such as LinkedIn, Facebook, X, YouTube, Instagram, and other social networking services. When individuals interact with our pages on those third-party platforms, the third-party’s privacy policy will govern your interactions on the relevant platform. If the third-party platform provides us with information about our pages on those platforms or your interactions with them (e.g. for lead generation purposes), we will treat that information in accordance with this Privacy Policy.

Please see the “Targeted online advertising” section for information about how to exercise choice regarding the use of browsing behavior for purposes of targeted advertising.

How We Use Personal Information

We use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

To operate the Site. We use your personal information to:

• Provide, operate, evaluate and improve the features and functionality of our products and services, including the Site

• Provide the services you request

• Manage reservations or in-person dining experiences and contact you about the status of your orders or reservations

• Delivering electronic receipts to consumers who request them via email or text message

• Communicate with you about the Site, including by sending you announcements, updates, security alerts, and support and administrative messages

• Personalize your experience with the Site and our communications

• Communicating with you regarding your account with us, if you have one, including by sending you service-related emails or messages (e.g., messages regarding account verification, changes or updates to the functionality of our products or services, technical and security notices and alerts, and support and administrative messages)

• Provide support and maintenance for the Site, including by responding to your requests, questions, and feedback

• Personalizing the manner in which we provide our products and services

• Maintaining records for Restaurants of their customers’ purchase activity and history

To send you marketing and promotional communications. The Restaurant or BentoBox may send you marketing communications. Please see the “Your Choices” section below for information about your choices regarding marketing communications.

To display advertisements. We work with advertising partners to display the Restaurant’s advertisements online. These advertisements are delivered by our advertising partners and may be targeted based on your use of the Site or your activity elsewhere online. To learn more about your choices in connection with advertisements, please see the section below titled “Targeted online advertising.”

To create anonymous or deidentified data. We may create anonymous, deidentified or aggregated data from your personal data and from other individuals whose personal data we collect. We make personal data into anonymous or aggregated data by excluding information that makes the data personally identifiable to you, and use that anonymous data for our lawful business purposes. We may share aggregated and anonymized information with third parties, for many of the same reasons that are described below.

For compliance, fraud prevention, and safety. We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to (a) comply with applicable laws and regulations, lawful requests, and legal processes, such as responding to subpoenas or requests from government authorities; (b) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (c) enforce the terms and conditions that govern the Service; and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

The purposes listed in the above clauses may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).

How We Share Personal Information

Service Providers
We may engage other companies and individuals to perform certain business-related functions on our behalf. Examples may include providing technical assistance, payment processing, billing, email management, customer service, marketing assistance, order fulfillment, delivery services, and reservation and online ordering systems. We authorize these parties to use personal information for the purposes set out in the section titled “How we use personal information,” but only as directed by us and in a manner consistent with this Privacy Policy, and are prohibited from using or disclosing your information for any other purpose.

Restaurants
When BentoBox performs services for Restaurants, it may share personal data with those Restaurants. If you establish an account for this checkout functionality, you may direct BentoBox to share your payment information with any restaurant that operates on our platform when making a purchase using the account.

Business Transfers
In connection with or during the negotiation of financing, merger, acquisition, dissolution, or similar corporate event, or the sale of all or some of BentoBox’s or the Restaurant’s assets, the information that BentoBox or the Restaurant, as applicable, have collected, including personal information, may be transferred as a business asset. If the company, business, or assets are acquired by another company, the acquiring company will possess the personal information that BentoBox or the Restaurant, as applicable, collected and we will make reasonable efforts to require the recipient to honor the rights and obligations regarding your personal information as described in this Privacy Policy.

Payment Processors and other Fiserv Companies
Your card data may be shared with Fiserv as needed to process credit card payments that you direct. Clover’s Privacy Notice is available at www.clover.com/privacy. Fiserv’s Privacy Notice is available at http://www.fiserv.com/privacy. We may also disclose your personal data to our subsidiaries and corporate affiliates – including those in the Fiserv group of companies – for purposes consistent with this Privacy Policy.

Professional advisors
We may disclose your personal data to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

Legal Requirements
We may disclose your information if required to do so by law, or in the good faith belief that such action or disclosure is necessary or appropriate to (i) operate the Site, (ii) comply with any legal obligation, report unlawful activity, cooperate with law enforcement or public authorities (including for the purpose of meeting national security or law enforcement requirements), (iii) protect against legal liability, (iv) protect and defend our rights, property, personnel, suppliers, sponsors, agents or licensors, (v) protect the personal safety of vendors, users of the Site or the public, or (vi) comply when compelled to disclose personal information to other third parties by government authorities or as required by law or regulation, including, but not limited to, in response to court orders and subpoenas. We may also share personal data with credit reference, fraud protection, risk management, and identity verification agencies to help guard against, detect, and respond to fraud or money laundering, and/or manage our or Restaurants’ risk, and ensure we comply with contractual, legal, or regulatory requirements.

Your Rights and Choices

In this section, we describe the rights and choices available to all users. Users subject to additional jurisdiction-specific disclosures may read additional information about their rights below.

Opt out of Marketing Communications
You may opt-out of marketing communications from the Restaurant by following such instructions as may be provided in the communication, or by otherwise contacting the Restaurant.

Cookies & Browser Web Storage
We may allow service providers and other third parties to use cookies and similar technologies to track your browsing activity over time and across the Site and third-party websites. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings.  Please note that if you set your browser to disable cookies, the Site may not work properly. Similarly, your browser settings may allow you to clear your browser web storage.

Targeted Online Advertising
Some of the third parties that collect information about users’ activities on or through the Site may be members of organizations or programs that provide choices to individuals regarding the use of their browsing behavior or mobile application usage for purposes of targeted advertising. Users may opt out of receiving targeted advertising on websites through members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance by clicking here. Please note that we also may work with companies that offer their own opt-out mechanisms and may not participate in the opt-out mechanisms that we linked above. If you choose to opt-out of targeted advertisements, you will still see advertisements online but they may not be relevant to you. Even if you do choose to opt out, not all companies that serve online behavioral advertising are included in this list, so you may still receive some cookies and tailored advertisements from companies that are not listed.

Do Not Track
Some Internet browsers may be configured to send “Do Not Track” signals to visited websites. BentoBox does not currently monitor, recognize, or honor any opt-out or do not track mechanisms, including general web browser “Do Not Track” settings and/or signals, in connection with the Site.

Accessing, modifying or deleting your information

In some jurisdictions, applicable law may provide a right for individuals to access, modify, or delete their personal data.

If you provide your information to a BentoBox-powered Site which is controlled by one of our Restaurant customers and wish to exercise these rights over information about your interaction, you need to directly contact the Restaurant you interacted with. We are a data processor and process information on its behalf. We will of course help our Restaurant clients to fulfill these requests to the extent required by law, such as by giving them the tools to do so and by answering their questions.

If you are a Restaurant, Restaurant employee, website visitor or other individual with whom BentoBox has a direct relationship, you may contact us directly to request access to, or modification or deletion of, your information in accordance with the law in your jurisdiction. We may not be able to provide access to, or modify or delete, your information in all circumstances. Please note that in certain cases a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.

To exercise these rights, you can email privacy@getbento.com.

Complaints

If you have a complaint about our handling of your personal data, you may contact our data protection officer using the contact information below. We request that a complaint be made in writing. Please provide details about your concern or complaint so that our data protection officer can investigate it. We will take appropriate action in response to your complaint, which may include conducting internal discussions with relevant business representatives. We may contact you for additional details or clarification about your concern or complaint. We will contact you to inform you of our response to your complaint. You also may have a right to file a complaint with a national or local regulatory agency.

How We Protect Your Information

BentoBox maintains security measures intended to protect your personal information in connection with your use of the Site. However, no security system is impenetrable and we cannot guarantee the security of your personal information.

Personal Information Retention

We will use your personal data for as long as necessary based on why we collected it and what we use it for and as directed by our restaurant clients. This may include our need to satisfy a legal, regulatory, accounting, or reporting requirement.

In general terms, we will retain your personal data for the duration of your involvement/engagement with us and for as long as reasonably necessary afterwards; however, we may maintain different retention periods for different products and services. There are also certain types of information which are required to be retained for a certain period by law.

International Data Transfers

The Site and its servers are located in the US, and we may have service providers located in other countries. If you are located outside of the US, please be aware that any information provided to us, including personal information, will be transferred from your country of origin to the US or other locations outside of your state, province, country, or other governmental jurisdiction where we or our service providers maintain offices and where privacy laws may not be as protective as those in your jurisdiction.

Important Notice for Individuals in the European Economic Area and the UK

If you provide your information to a BentoBox-powered Site which is controlled by one of our Restaurant customers, the merchant is your data controller and we are acting as a processor on their behalf.

We transfer your personal data within our corporate group, including outside of Europe or the UK. Sometimes we transfer your personal data out of Europe or UK within the Fiserv corporate group to countries not deemed by the European Commission or ICO to provide an adequate level of protection for personal data, in which case the transfer will be based on our Binding Corporate Rules, a copy of which can be found here. FDR LLC is the group company responsible for compliance with our Binding Corporate Rules.

When we transfer personal data outside of Europe or UK, within the group where the Binding Corporate Rules do not apply, or to third parties in countries not deemed by the European Commission to provide an adequate level of protection for personal data, the transfer will be made pursuant to:

• A contract approved by the European Commission or UK (called “Standard Contractual Clauses”);

• The recipient’s Binding Corporate Rules;

• The consent of the individual to whom the personal data relates; or

• Other mechanisms or legal grounds as may be permitted under applicable European or UK law

Please contact us if you would like to receive further information on the specific mechanism used by us when transferring your personal data out of Europe.

Fiserv has appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights when BentoBox acts as a controller, please contact the DPO using the details set out below:

Data Protection Officer, Fiserv
Email address: dpo@fiserv.com
Postal Address:
Janus House
Endeavour Drive
Basildon
Essex SS14 3WF.

External Websites

The Site may contain links to other websites and online services operated by third parties, which are not associated with the Restaurant and which the Restaurant does not control. We are not responsible for the content or the privacy policies or practices of those websites or online services. We encourage you to read the privacy policy and legal terms of websites or online services that you visit or use.

Changes to This Privacy Policy

This Privacy Policy is effective as of the date stated at the top of this Privacy Policy. We may change this Privacy Policy from time to time. Any such changes will be posted on the Site. If we make material changes, we will notify you by posting an announcement on the Site or sending you an email.

How to Contact Us

If you have questions about this Privacy Policy, please contact the Restaurant using the contact information provided on the Site.

Information for California Residents

The information provided in this “Information for California Residents” section only applies to residents of California whose information is processed pursuant to the California Consumer Privacy Act (“CCPA”).

As a California resident, you may have the rights listed in the section above titled “Accessing, correcting or deleting your information.” However, these rights are not absolute, and we may decline your request as permitted by the CCPA.

You are entitled to exercise these rights free from discrimination. This means that we will not penalize you for exercising your rights by taking actions such as by denying you goods or services, increasing the price/rate of goods or services, decreasing the service quality, or suggesting that we may penalize you as described above for exercising your rights.

How to exercise your rights
If you are a California resident, you may exercise your access, correction, and deletion rights as set forth above in the section titled “Accessing, modifying or deleting your information.”

• Identify verification. The CCPA requires businesses to verify the identity of the individual submitting the request before providing a substantive response to the request. A request must be provided with sufficient detail to allow us to understand, evaluate and respond. The requester must provide sufficient information to allow us to reasonably verify that the individual is the person about whom we collected information. A request may also be made on behalf of your child under 13.

• Authorized agents. California residents can empower an “authorized agent” to submit requests on their behalf. Businesses may require the authorized agent to have a written authorization confirming that authority.

Sale or Sharing of Personal Information for Cross-Context Behavioral Advertising

The Sites may use standard analytics and advertising tools that enable our analytics and marketing partners to collect personal information, such as Internet or other electronic network activity information. In some cases, these partners may use your personal information to serve you advertisements that are relevant to you based on your activity across our services and other sites (“cross-context behavioral advertising” or “targeted advertising”). However, please note that we do not knowingly sell or share the Personal Information of consumers under 16 without consent.

Personal Information That We Collect, Use, and Share

We do not sell personal information.  As explained in this Privacy Policy, the Site uses cookies and other tracking tools to analyze website traffic and facilitate advertising. If you would like to opt-out of the Site’s (and third-party advertising partners’) use of cookies and other tracking technologies, please review the instructions provided in the Online Tracking Opt-out Guide.  BentoBox may share the payment information you save in your account with Restaurants, at your direction.

Here is a summary of how we currently collect, use and share personal information, and how we have collected used and shared the information in the preceding 12 months.

Please note that we may also disclose personal information to comply with law, and for compliance, fraud prevention, and safety purposes; in the event of business transfers; and to our professional advisors, as further described above in the “How We Share Personal Information” section.

BentoBox Order Updates: SMS Terms & Conditions

Please read these SMS Terms & Conditions (the “SMS Terms”) carefully. By enrolling or otherwise agreeing to receive text messages from or on behalf of BentoBox CMS, Inc. (“BentoBox”), you agree to these SMS Terms, as well as BentoBox’s Privacy Policy, which are incorporated herein by reference and can be viewed at the link, or at getbento.com.

Program Description
BentoBox and its service providers may use an automatic telephone dialing system or other technology to deliver text messages to you to provide you with updates concerning orders placed using BentoBox (“BentoBox Order Updates”).

How to Opt Out and Get Help
To stop receiving text messages from BentoBox, you agree to reply “STOP” to the text message. After texting STOP, you may receive an additional communication confirming that your request has been received and processed. If you need further assistance related to the SMS Terms, text HELP to the number sending the message, or contact BentoBox customer service at support@getbento.com or (877) 353-2447. If you need assistance related to any orders, please contact the restaurant directly using the contact information provided on the restaurant’s website.

Message Frequency
The number of text messages that you receive will be recurring and vary depending on your interactions with us.

Supported Carriers
Your mobile carrier is not liable for delayed or undelivered messages.

Access or Delivery to Mobile Network is Not Guaranteed
It is your responsibility to determine if your mobile carrier supports text messaging and if your mobile device is capable of receiving text messages. Your receipt of the BentoBox Order Updates is subject to the terms and conditions of your agreement(s) with your mobile carrier. Delivery of information and content to a mobile device may fail due to a variety of circumstances or conditions. You understand and acknowledge that network services, including but not limited to mobile network services, are outside of BentoBox’s control, and BentoBox is not responsible or liable for issues arising from such network services (e.g., delayed or undelivered messages or the security of any messages).

Cost
Message and data rates may apply to each text message sent or received in connection with the BentoBox Order Updates, as provided in your mobile telephone service rate plan (please contact your mobile telephone carrier for pricing plans), in addition to any applicable roaming charges. BentoBox does not impose a separate fee for sending the BentoBox Order Updates.

Eligibility
To receive the BentoBox Order Updates, you must be a resident of the United States.By enrolling or otherwise agreeing to receive text messages from or on behalf of BentoBox, you represent and warrant that you are the current subscriber or authorized user of the phone number you have provided. You agree that you will not enroll or otherwise agree to receive messages from or on behalf of BentoBox using the mobile phone of any other person or entity without authorization.

Changes to the SMS Terms
These SMS Terms may be updated by BentoBox at any time without prior notice. By enrolling or otherwise agreeing to receive text messages from or on behalf of BentoBox, you agree to any changes.