7. PRIVACY RIGHTS AND ADDITIONAL NOTICES FOR RESIDENTS OF CALIFORNIA AND OTHER COVERED STATES

Effective Date: November 6, 2026

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, New Hampshire, Delaware, Iowa, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or any other U.S. state that has comparable data privacy legislation (collectively, "Covered States"), you may have certain additional rights concerning your personal information under: the California Consumer Privacy Act ("CCPA"), Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, New Hampshire Data Privacy Act, Delaware Personal Data Privacy Act, Iowa Consumer Data Protection Act, Nebraska Data Privacy Act, New Jersey Data Protection Act, Tennessee Information Protection Act, Minnesota Consumer Data Privacy Act, Maryland Online Data Privacy Act, Indiana Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Rhode Island Data Transparency and Privacy Protection Act, or similar laws that may be enacted in other U.S. states (collectively, "State Privacy Laws"). This section outlines the rights available to consumers in Covered States and how to exercise them.

These rights will apply only to the extent that you are considered a consumer of the Covered State and we are acting as a “controller” or “business” (as applicable) under State Privacy Laws with respect to your personal information.

General information regarding Eli’s collection, use, and disclosure of personal information is set forth in the Privacy Policy above. As described in greater detail in Section 3 and Section 4 above, the specific information we collect from you will depend on how you choose to interact with Eli’s and our Sites and Services. Depending on your level of interaction with us, we may not have collected your personal information from every listed category above. We collect and use your personal information for the business purposes described in Section 4 and Section 5 above, and retain it in the manner described above in Section 10.

Past 12-Month Personal Information Processing Categories

In the past 12 months, we’ve collected from our users the categories of personal information listed below. Additionally, we may share or “sell” the following categories of personal information to the recipients listed below for targeted advertising purposes:

Category	Collected From	Business Purpose	Third-Party Recipients
Identifiers & Contact Data	Directly from you; Automated browsing	Order fulfillment; Customer support; Marketing; Security	Shopify; Payment processors; Shipping carriers; Ad networks
Financial & Order Records	Directly from you	Processing payments; Gift cards; Transaction history	Shopify; Payment gateways; Fraud prevention vendors
Device, Usage & Geolocation	Automated tracking; Cookies; Geolocation	Site optimization; Analytics; Regional ads; Error debugging	Google Analytics; Ad partners; Cloud hosting providers
Inferences & Profile Data	Derived from activity & interactions	Tailoring product offers; Personalizing shopping experience	Analytics & marketing partners

Disclosure of Personal Information

The following charts summarize how Eli’s discloses personal information. As stated above in our Privacy Policy, although Eli’s does not sell personal information in exchange for money, some of the ways that we share personal information to enable Eli’s advertising may be considered “sales” or “sharing” under some State Privacy Laws. The first chart below shows the categories of personal information that we share for purposes of targeted advertising or otherwise “sell” for non-monetary consideration. The second chart shows the categories of personal information may we disclose for a business or commercial purpose.

We do not have actual knowledge that we sell or share the personal information of anyone under 16 years of age. 

Category of personal information	Category of third party recipient	Sharing/selling purpose
Identifiers	Advertising partners and social media platforms	Analytics, data strategy, consultation on, development or improvement of products and services, marketing, advertising, and related services for the benefit of Eli’s Cheesecake.  Co-marketing, targeted advertising, remarketing, and customized advertising content
Personal Records	Advertising partners and social media platforms	Analytics, data strategy, consultation on, development or improvement of products and services, marketing, advertising, and related services for the benefit of Eli’s Cheesecake  Co-marketing, targeted advertising, remarketing, and customized advertising content
***Characteristics of protected classifications	Advertising partners and social media platforms	Analytics, data strategy, consultation on, development or improvement of products and services, marketing, advertising, and related services for the benefit of Eli’s Cheesecake  Co-marketing, targeted advertising, remarketing, and customized advertising content
Commercial information	Advertising partners and social media platforms	Analytics, data strategy, consultation on, development or improvement of products and services, marketing, advertising, and related services for the benefit of Eli’s Cheesecake  Co-marketing, targeted advertising, remarketing, and customized advertising content
Internet or other electronic network activity information	Advertising partners and social media platforms	Analytics, data strategy, consultation on, development or improvement of products and services, marketing, advertising, and related services for the benefit of Eli’s Cheesecake
Geolocation Data	Advertising partners and social media platforms	Analytics, data strategy, consultation on, development or improvement of products and services, marketing, advertising, and related services for the benefit of Eli’s Cheesecake  Co-marketing, targeted advertising, remarketing, and customized advertising content

***Denotes above categories  that may be considered “sensitive” under some state privacy laws.

 

Disclosures for a Business or Commercial Purpose

Category of personal information	Category of recipient	Disclosure purpose
Identifiers	Service Providers that support our business and operations Professional advisors, auditors, and government bodies	Processing your purchases of or requests for products or services  Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on our behalf Providing advertising and marketing services Short-term, transient use, including, but not limited to, non-personalized advertising Auditing, related to ad impressions  Ensuring security and integrity of personal information Detecting, investigating, or protecting against fraudulent or illegal activity
Personal records	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on Eli’s behalf Providing advertising and marketing services Short-term, transient use, including, but not limited to, non-personalized advertising Auditing, related to ad impressions  Ensuring security and integrity of personal information Detecting, investigating, or protecting against fraudulent or illegal activity
Commercial Information	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on our behalf Providing advertising and marketing services Short-term, transient use, including, but not limited to, non-personalized advertising Auditing, related to ad impressions  Ensuring security and integrity of personal information Detecting, investigating, or protecting against fraudulent or illegal activity
Internet or other electronic network activity information	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on our behalf Providing advertising and marketing services Short-term, transient use, including, but not limited to, non-personalized advertising  Auditing, related to ad impressions Ensuring security and integrity of personal information  Detecting, investigating, or protecting against fraudulent or illegal activity
Geolocation data	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on our behalf Providing advertising and marketing services Short-term, transient use, including, but not limited to, non-personalized advertising  Auditing, related to ad impressions Ensuring security and integrity of personal information  Detecting, investigating, or protecting against fraudulent or illegal activity
***Precise Geolocation	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on our behalf Providing advertising and marketing services Short-term, transient use, including, but not limited to, non-personalized advertising  Auditing, related to ad impressions Ensuring security and integrity of personal information  Detecting, investigating, or protecting against fraudulent or illegal activity
Audio, electronic, visual, thermal, olfactory, or similar information	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf (e.g., providing communications, technical, analytical, or other services on our behalf)  Detecting, investigating, or protecting against fraudulent or illegal activity
Professional or employment-related information	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf e.g., fulfilling and delivering orders, processing payments, supporting our promotions, contests, gift cards, and providing communications services on our behalf Detecting, investigating, or protecting against fraudulent or illegal activity
Inferences	Service providers that we use to support our business and operations  Professional advisors, auditors, and government bodies	Performing services on our behalf (e.g., providing communications, technical, analytical, web hosting, cloud hosting and mobile application support, or other services on our behalf)  Providing advertising and marketing services Auditing, related to ad impressions  Ensuring security and integrity of personal information  Detecting, investigating, or protecting against fraudulent or illegal activity

***Denotes above categories  that may be considered “sensitive” under some state privacy laws.

In addition to the rights set forth in our privacy policy, your State Privacy Laws may, depending on your state, provide you the following rights:

Right to Know / Access: The right to request disclosure of the categories and specific pieces of personal information collected about you, the sources of this information, commercial purposes, and third-party recipients.

See the above charts for this information.

Right to Correction: The right to request correction of inaccurate personal information maintained in our records.

If you believe that personal information we maintain about you is inaccurate, you may submit a request for us to correct this information. Upon receipt of your verifiable correction request we will use commercially reasonable efforts to correct the information as you direct.

Right to Deletion: The right to request deletion of personal information, subject to statutory legal and transactional exceptions (e.g., completing active orders, fraud detection, legal obligations).

To request that we delete personal information that we collected from you, subject to certain exceptions, please submit your request to the contact information below. In response, we will delete, and instruct any applicable contracted service providers to delete your personal information, unless a permissible exception applies, such as:

Transactional: to complete a transaction for which the personal information was collected, provide a good or service requested by you, or perform a contract we have with you;

Security: to detect data security incidents;

Error Correction: to debug or repair any errors;

Legal: to protect against fraud or illegal activity or to comply with applicable law or a legal obligation, or exercise rights under the law, such as the right to free speech; or

Internal Use: to use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information (i.e. to improve our services).

Right to Opt-Out of Sale / Sharing / Targeted Ads: The right to direct us not to share or process personal information for cross-context behavioral advertising or non-monetary valuable consideration.

To opt out of the sale or sharing of personal information through cookies and other tracking technologies, please click the “Your Privacy Choices” link at the bottom of any page on our Site. If you wish to opt out of the offline sale or sharing of your personal information, please submit your request to us at the contact information below.

Right to Limit Sensitive Data: The right to limit the use and disclosure of sensitive personal information (such as financial details or precise geolocation) to strictly necessary operational functions.

You may direct us to limit the use and disclosure of your sensitive personal information to uses/disclosures that are reasonably necessary to provide our goods and services, or as needed to ensure security and integrity, or to prevent fraud or illegal activity. To do so, please submit your request to us at the contact information below.

Non-Discrimination: Your right to not be discriminated against for exercising your rights under the CCPA(CPRA), or comparable State Privacy Law. See directly below.

Statement of Non-Discrimination

Eli’s will never deny services, charge different prices, or provide lesser quality products to consumers who exercise their statutory privacy rights.

Statement of Financial Incentive Offers

Occasionally Eli’s may offer discounts, specials, or other promotions to consumers who have opted-in to receive these marketing communications from Eli’s by providing us with certain personal information, such as an email address or a phone number. Eli’s may also offer consumers opportunities to enter Eli’s related contests and sweepstakes that consumers who shared personal information with us by entering have a chance to win the contest or sweepstake. Each contest or sweepstake is governed by its own terms, and the specific financial incentive offered will be detailed in such terms. When we offer such discounts, specials, or promotions that may be deemed a financial incentive, the offer will include an explanation of its material terms. The nature and value of any such incentive will vary depending on the benefit provided and what information we collect. Most offers of this kind will involve one or more of the following categories of personal information: identifiers, personal records, commercial information (such as purchase records), and inferences.

You are not required to create an account with us to submit a CCPA(CPRA) Rights request.

Additional State-Specific Notices

Financial Incentives & Loyalty Programs: Promotions, discounts, or contest entries offered in exchange for email opt-ins constitute financial incentives under applicable law. In Colorado, if a customer rewards program is offered, consumers retain the right to delete rewards data, which may terminate your benefit to the linked reward.

Nevada Residents: Although Eli's does not sell covered personal information under Nevada law, Nevada residents may submit opt-out inquiries or request future notice by contacting customerservice@elicheesecake.com.

Rights Requests--Appeals: Additionally, for Colorado, Connecticut, or Virginia residents, if you have submitted a Rights request to us that you believe we have not reasonably fulfilled, you may contact us to appeal our decision by sending an email with the subject line “Privacy Rights Request Appeal” by email to customerservice@elicheesecake.com or mailing as a letter to Eli’s Cheesecake Attn: Customer Service; 6701 West Forest Preserve Drive Chicago, IL 60634.

Submitting a Privacy Rights Request to Us

There are three easy ways for residents of California and other Covered States to submit to us the rights requests that are afforded to them under their state’s State Privacy Laws. Residents of Covered States (or their authorized agents with written consent) may submit their legally-supported requests through three official channels:

Email: customerservice@elicheesecake.com

Postal Mail: The Eli's Cheesecake Company, Attn: Customer Service, 6701 West Forest Preserve Drive, Chicago, IL 60634

By Phone: (773) 736-3417 or Toll-Free Phone: (800) ELI-CAKE (Monday–Friday, 8:00 am–4:00 pm CST)

Verification & Response Timeline: When submitting certain Rights requests under the CCPA(CPRA) or comparable State Privacy Laws you must provide to us least three of the following pieces of information to verify your request: Your name, telephone number, e-mail address, mailing address, and last transaction amount. We will match this information to the information on our systems. For an online Rights request to delete, we will also send you a second verification to confirm that you would like your information deleted. To designate an authorized agent to act on your behalf, you must provide the authorized agent with your written permission to do so, which your authorized agent must submit to us at the time they place your Rights request on your behalf. Upon receipt of your verifiable request for information and/or request for deletion, we will, within 45 days of your request, disclose and deliver to you and/or delete your personal information from our files and direct any Service Providers to delete your personal information from their files. If necessary, we may extend this time period once by an additional 45 days, and will provide you with notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding our receipt of the verifiable request.