PRIVACY POLICY

This Privacy Policy (the “Privacy Policy” or “Policy”) describes how CKE Restaurants Holdings, Inc. (“CKE,” “we,” “us,” or “our”) collects, uses, and discloses Personal Information. This Privacy Policy is applicable to our websites, including www.ckr.com, www.carlsjrfranchising.com, and www.hardeesfranchising.com (collectively, our “Websites”) and other services that link to this Privacy Policy (collectively, our “Services”). Our brands maintain separate Privacy Policies, which can be found at www.carlsjr.com/privacy-policy, and www.hardees.com/privacy-policy.

By using our Services, you agree to our Personal Information collection, use, and disclosure practices, and other activities described in this Privacy Policy, and consent to our Terms of Use. If you do not agree, please discontinue your use of the Services.

1.  Personal Information We Collect 

“Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly with a particular person. It does not include information that is publicly available, deidentified, or aggregated.

The table below provides details as to the Personal Information we collect, why it is collected and how we use it. Please note that the Personal Information we collect about you will vary depending on how you interact with us and may not include all of the examples listed. 

In addition to the purposes described above, we may use and disclose any category of Personal Information we collect to respond to law enforcement requests, or as otherwise required or authorized by applicable law, court order, or governmental regulations; to protect our rights and interests and those of others, including our brands and franchisees; to resolve any disputes; to enforce our terms and policies; and to evaluate or conduct a merger, sale, or other acquisition of some or all of our assets. We also reserve the right to use Personal Information we collect for any other purpose identified in an applicable privacy notice or agreement between you and us, or otherwise with your consent.

2.  Sources of Personal Information

We collect the categories of Personal Information listed above from the following sources:

• Directly from you. We collect Personal Information about you when you interact directly with us or our Services—for example, when you complete a form on our website or submit a franchise application.
• From our affiliates, brands, and franchisees. We collect personal information from affiliated companies, from our brands, and from franchisees in order to carry out the purposes described above.
• Through tracking technologies in use on our Websites. When you use our Websites, we use technologies such as cookies and pixels, which process certain types of Personal Information (please see below for more information).
• From our service providers. We hire vendors to help with certain aspects of our business. Some of these vendors, such as those that assist with processing payments, or providing communications, technical, analytical, web hosting, cloud hosting, or other support services may collect Personal Information on our behalf.
• Other sources. We may also collect Personal Information from other companies—for example, from internet service providers, data analytics providers, advertising networks, social networks, and third parties from which we may license or purchase data.
• Created by us. We may create some types of Personal Information about you—for example, when we draw inferences from other categories of Personal Information we collect or if we assign you with a username and login information for our Services.

3.  Cookies and Other Tracking Technologies 

When you use our Websites, we and some of our service providers may process certain information through the use of common online tracking tools such as cookies, pixels and web beacons. Cookies are small files that a website transfers to your device through a web browser that enable the site’s or a third party’s systems to recognize your device and capture and remember certain information. In general, we and our service providers use cookies and other tracking technologies (such as web beacons, tracking pixels, and HTTP referrers) to optimize the functionality of our website, to help us understand how our website is used, and to provide users with interest-based content based on their browsing activities. 

If you do not want to have cookies placed on your device, you should set your browser to refuse cookies before accessing our website. Please review your browser’s Help menu for instructions, or visit www.allaboutcookies.org for more information on disabling and deleting cookies. Please note that, if you turn cookies off, some features of our website may not function properly. 

We do not currently recognize the “Do Not Track” signal.

4.  Google Analytics 

We use analytics tools including Google Analytics to analyze how you interact with our websites. This software may collect information such as your IP address, location, operating system, access time, duration of visit, and actions you take on our websites. Google Analytics is owned and controlled by Google LLC. Data collected by Google is subject to its privacy policy. You may opt-out of having your website activity made available to Google Analytics by installing the Google Analytics browser add-on, available here.

5.  Disclosures of Personal Information 

Disclosures for business or commercial purposes. We disclose Personal Information to our service providers and contractors for the business or commercial purposes described in Section 1 above and as further detailed below. 

1. Affiliates and acquisitions. We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage. 
2. Franchisees. While this Policy does not apply to any Personal Information collected and processed solely by our franchisees in or in connection with restaurants they own and independently operate, we do share limited information with our franchisees to ensure you have a seamless experience. For example, if you place an order through our Services for delivery from or pick up at a franchisee restaurant, we may need to share Personal Information so that your order can be prepared and processed. 
3. Service providers acting on our behalf. We may share your information with service providers who assist us with our business operations.
4. Other disclosures with your consent. We may disclose your information to other third parties when we have your consent or direction to do so. 

We disclose the categories of Personal Information we collect to the recipients described above for the following business purposes:

• Processing transactions and requests for products or services.
• Performing services (including processing, maintaining, or collecting Personal Information) on our behalf and/or to support our brands and franchisees (e.g., processing payments, supporting promotions, contests, gift cards or loyalty programs, and providing communications, technical, analytical, web hosting, cloud hosting and mobile application support, or other services).
• Ensuring security and integrity of Personal Information.
• Debugging to identify and repair errors that impair existing intended functionality.
• Short-term, transient use, including, but not limited to, non-personalized advertising.
• To personalize your Website experience and to deliver content, product and service offerings relevant to your interests, including targeted offers through our Services, and third-party sites (except for cross-context behavioral advertising). 
• Undertaking internal research for technological development and demonstration.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us.
• Detecting or protecting against malicious, deceptive, fraudulent or illegal activity.

Targeted advertising, sales, and sharing of personal information. Although we do not sell Personal Information in exchange for money, some of the ways in which we share Personal Information with our franchisees may be classified as “sales” or “sharing” under certain state privacy laws. The categories of Personal Information we “sell” or “share” include: Identifiers; Personal records; Commercial information; and Inferences. Our purposes for selling/sharing Personal Information relate to the support we provide to our franchisees, which are independent businesses that operate restaurants under our brands. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age. We do not sell or share Personal Information we obtain for text messaging programs (including opt-in consent data) with third parties. If you would like to opt out, please see the information below for your state of residence.

6.  How Long We Keep Personal Information 

We keep the categories of Personal Information described above for as long as necessary for the purposes described in this Privacy Policy or otherwise authorized by law. This generally means holding the information for as long as one of the following apply: 

• Your Personal Information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected the information;  
• Your Personal Information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the Personal Information was collected; 
• The Personal Information is reasonably required to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case); or 
• We are otherwise required or permitted to keep your Personal Information by applicable laws or regulations. 

Where Personal Information is used for more than one purpose, we will retain it until the purpose with the latest period expires.

7.  Privacy Rights for Residents of Covered States 

Some US states provide certain individual rights regarding Personal Information. If you are a resident of California, or a consumer who lives in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Tennessee, Utah and Virginia. (collectively, “Covered States”), you may submit a request to exercise your privacy rights using one of the following methods:

• ONLINE REQUEST FORM. You may submit a request via our Consumer Portal located on our privacy page here.
• TOLL-FREE TELEPHONE CALL. You may submit privacy-related requests by calling our toll-free Privacy Request Hotline at 1-800-227-5757. PLEASE NOTE, THIS PHONE NUMER IS FOR PRIVACY REQUESTS ONLY. WE WILL NOT RESPOND TO UNRELATED MESSAGES. Please contact customer support via our online webform for any non-privacy issues: https://www.ckr.com/contact-us. 

Please note that, depending on the nature of your request, you may be asked to log into your account or to provide 2-3 pieces of Personal Information that we will match against our records to verify your identity. Depending on the type of request that you make, we may require you to provide a signed declaration affirming your identity. In some states and for some types of requests, you may use an authorized agent to submit a request on your behalf using the methods described above. Your agent will need to provide either: (1) a power of attorney; or (2) your written permission to allow the authorized agent to submit the request on your behalf. If you submit a request through an authorized agent, you will still need to verify your identity directly with us before your request can be processed. We will not discriminate against you if you choose to exercise any of your privacy rights under the Covered State privacy laws.

• Right to know categories of Personal Information. If you are a California resident, you have the right to request more information regarding the categories of personal information we have collected about you, including:

• The categories of sources from which the personal information was collected; 
• Our business or commercial purposes for collecting, selling, or sharing personal information;
• The categories of recipients to which we disclose personal information;
• The categories of personal information that we sold, and for each category identified, the categories of third parties to which we sold that particular category of personal information; and
• The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of recipients to which we disclosed that particular category of personal information.

• Right to access Personal Information. Residents of Covered States have the right to confirm whether we are processing their Personal Information, to access their Personal Information, and to obtain a copy of certain Personal Information in a portable format. If you are an Oregon consumer, you may also request a list of third parties to which we disclosed Personal Information.
• Right to correct inaccurate Personal Information. If you are a resident of a Covered State and you believe that Personal Information we maintain about you is inaccurate, you have the right to request that we correct that information.
• Right to request deletion of Personal Information. Subject to certain exceptions, residents of Covered States have the right to request that we delete Personal Information. Where we use deidentification to satisfy a deletion request, we commit to maintaining and using the information in deidentified form and will not attempt to reidentify the information.
• Right to opt-out of targeted advertising, sales and sharing of Personal Information. Some state privacy laws provide the right to opt out of the “sale” of your Personal Information, and to request that we do not share your Personal Information for targeted or cross-context behavioral advertising. To opt-out, please click here. We also recognize Global Privacy Control (GPC) signals enabled through a web browser or web browser extension as valid opt-out requests where required by applicable law. Please note that your opt-out preference signal will be applied only to the browser you use to access each of our Websites.
• Right to Limit the Use of Sensitive Personal Information. We do not use Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the California Consumer Privacy Act. 
• Right to opt out of profiling. Some Covered State privacy laws provide the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. We do not engage in practices that qualify as profiling producing legal or similarly significant effects under applicable state privacy law.

1. Right to appeal. Sometimes we are unable to process requests relating to your Personal Information, in which case, your request will be denied. If your privacy rights request has previously been denied by us, you believe we denied it in error, and you are a resident of one of the states that includes the right to appeal, you may appeal for reconsideration of your request using our webform here . 

8.  Notice to Nevada Residents 

Nevada residents may opt out of the “sale” of “covered information” to third parties, including but not limited to name, address, social security number, telephone number, email address, and other information through which a person may be contacted. We do not see Personal Information as defined under Nevada law. If you have any questions or if you would like to receive notice by email in the event we should engage in “sales” of Personal Information under Nevada law in the future, please contact us using the contact information provided below.

9.  Communication Choices

You may opt out of our commercial email communications by clicking the Unsubscribe link contained in our emails. If you opt out, we may still send you administrative, operational, and transactional emails relevant to your relationship with us. If you receive text messages and alerts on the mobile phone number(s) you disclose to us, you may opt out by sending us a text message from your mobile phone with the word STOP, and we will unsubscribe you from text message communications. For more information on our text-messaging program, please see our Text-Messaging Terms .

10.  Accessibility 

You may be able to enable accessibility features on our Website to make this Privacy Policy more accessible to you. You may also contact us using the information below to request a copy of this Privacy Policy in an alternate format.

11.  Security of Personal Information 

At no cost to you, we take commercially reasonable steps to protect Personal Information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Nevertheless, transmission via the internet and digital storage are not completely secure, and we cannot guarantee the security of information collected through the Services.

12. Changes to This Privacy Policy

We may change our Privacy Policy and practices over time. We will indicate changes to this Policy by updating the Effective Date at the top of this page. Your continued use of the Services after any update to this Privacy Policy will constitute your acceptance of the changes

13. Contact Us

If you have questions about this Policy our privacy practices, please contact our privacy team through one of the following methods:

• EMAIL: privacy@ckr.com

1. MAIL: 6700 Tower Circle, Suite 1000
   Franklin, TN 37067

Last Updated: March 10,  2025