CAVA Privacy Policy

Last Updated: October 7, 2024 

Cava Group, Inc., and its direct and indirect subsidiaries, including CAVA (collectively, “CAVA,” “we,” “us,” or “our”) are committed to protecting the privacy of our customers and others who visit one of our locations, use our app, or engage with us online or through email or text. This Privacy Policy (“Policy”) describes our privacy practices, including how we currently collect and use personal information, and our practices during the past year. The Policy applies to personal information we gather online and offline. This Policy does not apply to other types of online or offline personal information collection or uses that are not controlled by CAVA. For instance, if we provide a link to another company’s website, we cannot control how that company might collect or use your personal information when you leave our website. 

If you have questions about our privacy practices, please email us at [email protected] or call us toll free in the United States at 1-844-707-6841. 

We recommend that you read our entire Policy carefully before giving us your personal information but, if you are short on time, here is a brief description of our privacy practices. 

Personal information is anything that can identify you directly or indirectly in combination with other information about you. Personal information does not include publicly available information and information that cannot be linked to you. When you place a CAVA order, we will need your name, contact information (if the order is being delivered), and payment details. If you sign up for a CAVA account or join our rewards program, we will ask for your phone number, birthday, and account password. Depending on the settings you choose for your browser and device, we may also get details about the device you use, how you browse our website, and your use of our app. You can choose to give us additional personal information through completing surveys, contacting us, or engaging with CAVA on social media. 

We primarily use personal information to get you the food you order from CAVA, directly or indirectly. If you create an account or join our rewards program, we will use personal information such as your purchase history and dietary preferences to better understand you and to account for your rewards points. We use your personal information to send you marketing communications unless you unsubscribe. We also use personal information as needed to operate our business, including to advertise, improve the food we offer, and decide on new locations. 

We sell personal information for valuable consideration – not in exchange for money. We also share personal information for targeted advertising and cross-context behavioral advertising. You may opt out of the sale of personal information and its use for targeted advertising and cross-context behavioral advertising by contacting us at [email protected] or calling us toll free in the United States at 1-844-707-6841. Additional ways to opt out are identified in our full Policy. 

We generally keep your personal information for as long as we are using it for the reasons described in this Policy or longer if we need it for a legal requirement. When deciding how long to keep personal information, we consider our legal obligations, the amount and sensitivity of your personal information, and whether we reasonably need to keep your personal information. 

We collect the following categories of personal information. We do not collect every type of personal information from every person. The specific personal information we collect about you will depend on how you interact with us. 

• Identifiers – such as your full name, phone number, email address, month and day of birth, device identifiers, account log-in information, and Internet Protocol (IP) addresses, which can tell us your general location. 

• Nonpublic personal details, including as defined under Cal. Civ. Code § 1798.80(e) – such as your signature, postal address, or credit or debit card information, which may also be collected and processed by our payment processing vendor. 

• Commercial information – such as items you have ordered at CAVA, your favorite orders, or your dietary preferences. 

• Internet and other electronic network activity – such as what you search for on our website or look for in our app or how you interact with our website, app, marketing communications, advertisements, or social media pages. When you interact with any of our social media accounts or pages, we may collect personal information you provide or make available, for instance through commenting on our social media page or mentioning us on your social media account. If you choose to login to your CAVA account using your social media account, CAVA and the social media service will be able to share certain information about you and your activities with each other. We may also get information about how you use the wifi at our locations if you choose to connect to it. 

• Audio, visual, or similar information – such as call recordings when you call our customer service or video recordings from video cameras used at our locations. 

• Inferences – such as those drawn from other personal information we collect to create a profile about your preferences. 

• Sensitive personal information – We collect health information in limited circumstances, such as if you have an accident at one of our locations. We also work with vendors that may collect precise geolocation data, such as to identify the closest CAVA restaurant to you when you choose to permit location services. 

You understand that any biometric data collected in connection with your use of Apple, Inc. or Google, Inc. technology is not shared with CAVA and CAVA does not have access to any of your biometric data, which will be stored on your own device. 

CAVA collects additional categories of personal information from job applicants and our employees. If you are a prospective employee, job applicant, or employee, you can view additional information by visiting our Employee and Job Applicant Privacy Notice at https://cava.com/ca-empapp-notice.  

We collect personal information from the following sources: 

• You – We will collect any personal information you choose to give us. This may include personal information that you provide when you create an account, place an order, or communicate with us through our website, app, or social media or in person in our locations. We may also collect personal information when you reach out for assistance, attend an event, or participate in a sweepstakes, contest, promotion, or program we sponsor. 

• Cava Group companies – We may get personal information about you from other Cava Group companies. 

• Our service providers and vendors. Our service providers and vendors may collect personal information on our behalf or provide us with additional information about you. We also work with vendors to conduct market research and assist with our marketing and advertising, including social media companies. These vendors may give us personal information about CAVA customers or potential customers. 

• Information collected passively. When you interact with our website, app, and advertisements, we and our vendors may use tracking technologies to obtain information about those interactions. Some of the data that these tracking technologies collect may be considered personal information. For more information about these tracking technologies, please see the Tracking Technologies and Social Media Sharing section below. 

We typically use personal information in one or more of the following ways or for another reasonably expected or compatible purpose. 

• Provide services to you, including to make sure you receive the products you order and the level of service you expect from CAVA. We use personal information, including identifiers, nonpublic personal details, commercial information, internet and other electronic activity, inferences, and audio, visual, or similar information, to permit you to use our website and app, for example to place orders and obtain rewards points, and to enjoy our locations. We also use personal information to improve our products and services and to make sure that our website, app, and locations work as you expect. For example: 

• If you create a CAVA account and enroll in our Rewards Program, we collect your name, phone number, email address, month and day of birth, information about your purchases and preferences, and any additional information you choose to submit, such as your address or payment card details. We use this information to service your account, process payments and complete your orders, award and redeem rewards points, and contact you about new products, services, or information that we think may be of interest to you. 

• If you place an order at CAVA, we will collect your name, payment card details, and any other information needed to get your order to you, such as your address and phone number for delivery or the names and contact details of gift card recipients. We use this information to process and complete your order. We may also contact gift card recipients with information of interest to them. You or your gift card recipients can opt out of our marketing communications at any time by using the “unsubscribe” link included in each communication. 

• CAVA’s internal business needs and our marketing. We may use any personal information we collect as reasonably necessary to operate our business, including for the following: 

• When you use our website or app, we collect identifiers and internet and other electronic activity related to your visit. We may be able to determine your general location based on the IP address. We use the personal information we collect during your use of our website and app to identify you and facilitate your login, to improve our products and services by understanding how people use our website and app, to provide recommendations to you, to prevent fraud, and to deliver relevant targeted advertising and offers. 

• If you call us, we may record your call and, when you visit one of our locations, we may record you on video. We use this information to monitor our customer service, maintain the security and safety of our locations, and train our employees. 

• We collect your birthday and preferences, such as your favorite CAVA location or order and dietary preferences and use this information to improve our services, provide you with information about CAVA’s products, and understand our customer preferences. We may use computer analytics to understand and predict customer preferences and associate this information with you. This information helps us gauge and develop our marketing activities, measure the appeal and effectiveness of our products and locations, and provide more relevant information, advertising, and offers to our customers and potential customers. 

• We may use your contact details to send you marketing communications and keep you updated. You may opt out of our marketing communications by changing your communication preferences at any time in your account settings or by following instructions provided in the communication. 

• CAVA uses internet and other electronic information to deliver targeted advertising. We may combine commercial information with other personal data to measure the effectiveness of our services, to create inferences, and to provide targeted information, advertisements, and offers. 

• Communicate with you, including to provide customer support when you request it. We use your personal information, including identifiers, nonpublic personal details, commercial information, and audio, visual, or similar information to communicate with you, including to send you messages about the availability or security of our website, app, or locations and other product or service-related issues. When you contact customer service, we will use information you provide to help solve your problem or concern and may use a recording of your customer service call or other communication details for quality control, training, and service improvement. We also send administrative or account-related information to keep you updated about your account and your orders. Our administrative communications are not promotional in nature, and you cannot opt out of them. You may opt out of other communications by changing your communication preferences at any time in your account settings or by following instructions provided in the communication. 

• Maintain safety and security and enforce our policies. We may process any personal information in connection with monitoring, investigating, preventing, and mitigating prohibited or illegal activities on our website or app or in any CAVA location. We also may process any personal information as reasonably necessary and appropriate to protect our rights, property, security, and safety or those of others, including our employees and customers. For example, we may use your identifiers and internet and electronic activity information to combat spam, malware, and other malicious activities or security risks; to monitor and improve our security measures; and to verify your identity to help protect your account. When you access or use our website and app, you are bound by our Terms of Use and this Policy, and we may use any personal information to enforce compliance. 

• Legal and regulatory compliance. CAVA is subject to laws and regulations that may require us to process your personal information. For example, we may collect your personal information to be able to comply with food safety obligations imposed on us by the U.S. Food and Drug Administration. We may also use your personal information to respond to law enforcement requests or when required by law, court order, or regulations. 

• Business transactions. We may use or share any personal information when we engage in a sale, merger, transfer of our business (in whole or in part), or other transaction involving our assets, including for the negotiation of any such business transactions. 

Any personal information we collect may be disclosed to any of CAVA’s vendors and to other parties as reasonably necessary to facilitate the uses identified above. Any personal information will be shared throughout CAVA, and any personal information may be disclosed when you direct us to disclose the personal information. The following categories identify other parties that may have access to the personal information CAVA collects. 

• Our service providers and vendors. We may disclose your personal information to the service providers and vendors we engage to help operate our business. For example, if you order CAVA delivery through DoorDash, Uber Eats, or GrubHub, we may share personal information necessary to provide you with your order. We also engage vendors to assist us with promotions, data analytics, customer service, payment processing, website and app management, IT services, and marketing and advertising. Each of our service providers and vendors may have access to the personal information necessary to be able to perform the services for which we engaged them. We also authorize certain service providers to collect personal information on our behalf, including our advertising and social media partners who may collect and share personal information for cross-context behavioral or targeted advertising purposes. 

• Business partners. Sometimes we collaborate with other businesses on special products, events, or promotions. Personal information collected and used through this type of collaboration will be shared between CAVA and its business partner(s). These business partners typically have their own privacy statements that explain their privacy practices. 

• Governmental authorities and related third parties. We will disclose personal information as reasonably necessary to comply with laws; respond to civil, criminal, or regulatory inquiries, investigations, subpoenas, or summons; cooperate with law enforcement agencies; detect, investigate, and prevent fraud or other unlawful activities; protect and defend ourselves, our property, our employees, our customers, and others; and exercise or defend legal claims. 

• Successors to our business. If all or a portion of our business is sold, we will disclose personal information as part of that business transaction, including the negotiation of it. 

To determine an appropriate retention period for personal information, we consider various factors such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we process your personal information; and applicable legal requirements. In general, we retain personal information for as long as necessary to provide you with the CAVA products or services you request, while you have an open account with us, and/or as needed for the purposes described in this Privacy Policy. We may retain your personal information for longer if necessary to comply with legal obligations, resolve disputes, or as permitted or required by applicable law. We may also retain your personal information in a deidentified or aggregated form so that it can no longer be associated with you and is no longer consider personal information. 

Participating in any CAVA financial incentive program is completely voluntary. For any financial incentive we offer, we have made a good faith calculation that the value of the personal information you provide is reasonably equivalent to the expenses we incur to provide you with the financial incentive offered. Our expenses include the collection and safeguarding of personal information, administration of the financial incentive offered, marketing costs, technical services, fraud prevention, event coordination, and employee training. 

CAVA Loyalty Rewards Program. CAVA customers may participate in our CAVA Loyalty Rewards Program (the “Rewards Program”), which permits you to earn program credits on eligible CAVA purchases and to redeem your credits for CAVA food and beverage purchases. To enroll, we collect your name, email address, phone number, and birthday. You can associate other personal information with your Rewards Program account, such as your address, delivery instructions, and dietary preferences. Rewards Program members may also receive exclusive offers, discounts, invites to events, sneak peeks at new menu items, special birthday gifts, and other surprise rewards. 

When you participate in the Rewards Program, you allow CAVA, our service providers and vendors, and our business partners to send you marketing communications and permit us to collect and use information about your purchases at CAVA. Rewards Program benefits may be considered “financial incentives” provided in exchange for your personal information under some laws, including the California Consumer Privacy Act (“CCPA”). 

You can enroll in the Rewards Program at https://cava.com/rewards or by clicking “Sign In” and then “Sign Up” or “Create an Account” on our website or app and completing all required fields. You can withdraw from the Rewards Program at any time by submitting a request to our support team at https://support.cava.com. For additional information about our Rewards Program, see our CAVA Rewards Terms and Conditions at https://cava.com/rewards. 

CAVA Survey Participation. We may offer our customers voluntary opportunities to participate in surveys, email opt-ins, or other opportunities through which we may collect personal information, such as your name, email address, preferences, and opinions. In exchange for participation, you may be offered a financial incentive, such as a discount or coupon. If you change your mind about participating, please contact us at [email protected]. 

We use cookies, pixels, and other tracking technologies (together, “Tracking Technologies”) on our website and app as well as in our email communications and targeted advertising to collect and store certain types of information. These Tracking Technologies can uniquely identify you, your browser, or your device and store and transmit information back to us or one of our service providers or vendors. Tracking technologies can perform various functions such as identifying fraudulent website users, recalling that you are already logged in, keeping track of the website pages or products you view, or delivering targeted advertising. For example, our marketing emails may contain clear gifs or web beacons that let us see if you opened an email received from CAVA or clicked a link within it.  

Tracking Technologies can permit us to track information about you over a period of time or as you navigate across different websites, applications, or devices. We and our vendors may use the information that is collected to establish connections among the different devices or browsers you use to identify you as a user of all devices or to associate you with online profiles you may have, such as those on social media sites. This means that information about your online activity on one device, such as your laptop, may be combined with information about your online activity on another device, such as your mobile phone. This combined information may be used across all devices you use to deliver targeted advertising, to limit the number of times you see an ad, and to help measure the effectiveness of advertising campaigns.  

We partner with companies, including social media companies, who use Tracking Technologies to collect information about you on our behalf. This information is used to provide targeted advertisements about goods and services that may be of interest to you. With sufficient data from various sources, these advertising companies may be able to personally identify you. Your use of CAVA’s website and app may also be associated with you specifically if you have an existing user profile through one of the companies we partner with, such as Google, Facebook, Instagram, or TikTok.  

We also use third-party analytics tools to help us better understand how our website is used by website visitors. The information collected by these analytics tools will tell us things such as which search engine referred you to our website, how you navigated around our website, and what you purchased. We have, for example, implemented Google Analytics Advertising features such as dynamic remarketing, interest-based advertising, audience targeting, behavioral reporting, demographics and interests reporting, user segment analysis, device reporting, display advertising, and video ads reporting. The information generated by our use of Google Analytics is subject to Google’s privacy policies. For more information about how Google Analytics uses data, visit www.google.com/policies/privacy/partners/. To opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout.  

Our website may contain embedded content, such as videos hosted on another service that are visible on our website. Tracking Technologies associated with embedded content are those of the content provider. The content provider is also responsible for the data collection from the embedded content. Any personal information collected will be subject to the content provider’s privacy practices.  

Additionally, we offer social media sharing features or other integrated tools to let you share CAVA content on your social media. The visibility of any content you share will depend on the settings you establish for the social media site through the site’s settings. Like embedded content, your interactions with social media sharing features are governed by the privacy policies of the social media companies that provide them.  

Tracking Technologies – Your Choices. You can choose to block some of these Tracking Technologies when you visit our website, but some parts of our website may not work as expected if Tracking Technologies are blocked. For instance, we may not be able to recognize you as a returning customer, save your preferences, or find the CAVA location closest to you. Opting out of targeted advertising will not prevent you from receiving advertising about CAVA or other companies, but the advertising you see may not be as relevant to you or your interests.  

• Browser-Based Opt Outs. You may be able to disable Tracking Technologies using your web browser settings. Please review your browser’s instructions or visit All About Cookies for general information. Note that your web browser may have settings that allow you to transmit a “Do Not Track” signal when you use online services. Like many websites, our website is not currently designed to respond to “Do Not Track” signals received from browsers. 

• Self-Regulatory Program Opt Outs. Two self-regulatory programs are available to help you control the use of Tracking Technologies on your browsers and in apps — the Digital Advertising Alliance and the Network Advertising Initiative. Both programs help to regulate vendors in the digital advertising space. One function of their self-regulatory programs is to give you the ability to opt out of targeted advertising, including the use of Tracking Technologies, from their member companies. You can visit the Digital Advertising Alliance’s Your Ad Choices website to opt out of targeted advertising for participating vendors or use their AppChoices tool for adjusting your mobile device advertising preferences. The Network Advertising Initiative similarly assists with opt outs through their Opt Out of Interest-Based Advertising webpage or, to opt out in mobile apps, visit their Mobile Device Opt Outs webpage. 

• App Deletion. You can stop all collection of personal information by our app by simply uninstalling it. You may use the standard uninstall process for your device. 

Be aware that you will need to opt out separately on each browser or device you use, as opt outs are typically specific to a single browser or device. Resetting your device and other actions you take to remove information from your device or browser may remove your opt-out choices or prevent them from working as intended. 

We may directly send you marketing communications via email or use a vendor to send these messages on our behalf. To opt-out of receiving our marketing communications, please click the “unsubscribe” link in any marketing communication you receive. 

You can also choose to receive text messages from us. When you sign up to receive text messages, we will text you marketing communications and reminders as well as information about your orders. You may opt out of receiving text messages at any time by replying “STOP” to any text message you receive from us. Data obtained from texts will not be shared with other parties for their own marketing purposes. For more information, see our SMS Communications Terms and Conditions at https://cava.com/messaging.  

You may update certain communication and advertising preferences by either logging into your CAVA account and updating your account settings or changing the relevant settings for our app on your device. 

Our website and app are not intended for children under the age of 18, and we do not knowingly collect personal information from children under the age of 18 on our website or app. If we become aware that we have received personal information from a child under the age of 18, we will delete such information in accordance with applicable law. Please note that we may permit job applicants or employees that are 16 or 17 years old to provide employment-related personal information for purposes related to employment with CAVA, as explained in our Employee and Job Applicant Privacy Notice at https://cava.com/ca-empapp-notice.  

This section supplements the information provided throughout this Policy and applies to residents of California and other states, such as Colorado, Connecticut, Texas, and Virginia, with comprehensive privacy laws in effect unless otherwise stated. All other provisions of this Policy continue to apply. 

Your State Privacy Rights. You have the following rights under certain U.S. state privacy laws.  

• Know. You have the right to ask for information about the personal information we have about you, including the categories of personal information we have collected about you, the sources of that personal information, what categories of personal information we have sold or used for targeted advertising or cross-context behavioral advertising, the categories of parties that received your personal information from us, and our purposes for collecting, selling, or sharing your personal information. 

• Access. You have the right to know whether we have your personal information and to access that personal information in a useful and portable format. 

• Delete. You have the right to ask that we delete your personal information. 

• Correct Inaccuracies. You can ask us to correct inaccuracies in your personal information. If you have a CAVA account, you can review, update, and change your personal information in your account settings whenever you want. 

• Opt Out of the Sale of Personal Information and Targeted Advertising. We sell personal information for valuable consideration (not in exchange for money). We also share this personal information with our vendors to assist with our cross-context behavioral advertising and targeted advertising efforts. We sell and share identifiers and nonpublic personal details, such as email, device IDs, and IP addresses; commercial information, such as your purchase history; inferences; and internet and electronic activity information, such as details about your interactions with our website, app, or ads. You have the right to opt out of our sale of your personal information and targeted advertising or cross-context behavioral advertising, which you can do by one or more of the following: 

• When you visit a CAVA website that collects personal information through Tracking Technologies, you will be shown a banner that offers you the option to accept or reject the use of Tracking Technologies. By clicking “Opt Out/Do Not Sell or Share,” you will opt out of the sale of your personal information and its use for targeted advertising. Please note that your request to opt-out will be linked to your browser identifier only. If you use a different browser to access our website, you will need to confirm your choice again. 

• You can also set a browser-based opt-out preference signal (such as the Global Privacy Control) which we recognize through our consent management vendor. Please note that if you use the browser-based opt-out preference signal, you will need to set it on each browser you use. 

• Email [email protected] or call us toll free at 1-844-707-6841 and ask to opt out. 

• Opt Out of Profiling. We do not engage in profiling that results in legal decisions or has a similarly significant impact on you and do not offer the right to opt out of profiling. 

• Limit the Use of Sensitive Personal Information (California only). We only use sensitive personal information for legally permitted purposes, so this right does not apply. 

 How to Exercise Your Privacy Rights. If you would like to exercise your privacy rights under an applicable law, you, or a person you designate to make the request, may submit privacy requests using CAVA’s Privacy Request Form at https://cava.com/data-request, by emailing us at [email protected], or calling us toll free at 1-844-707-6841, so long as you are provided the express right to under applicable statute. We use commercially reasonable efforts to verify your identity after you submit a request by comparing details provided in your request with personal information in our systems. We may ask you to provide more information to help confirm your identity or to clarify your request before your request can be processed. If someone else submits a request for you, we may ask you to verify your identity or confirm the request. If we cannot confirm your request or your identity, we may not be able to act on your request.  

We endeavor to respond to privacy rights requests within 45 days of receipt of the request along with any identity verification or clarifying information. We will let you know if it will take us longer to respond. We will typically respond to you via email, unless you specify a differ method of response, such as postal mail. If you are not satisfied with our response to your privacy request, you can ask us to reconsider our decision by responding to any communication you have received regarding your request. We will not discriminate against you for exercising any of your legal rights.   

California’s Shine the Light Law. California residents may ask CAVA to give them information about personal information that CAVA has disclosed to other parties for those parties’ direct marketing purposes during the immediately preceding calendar year. California residents may make one such request per calendar year. California residents may submit a Shine the Light request using the contact information in this Policy. In your request, please state that you are a California resident and provide a current California mailing address for our response. 

CAVA operates in the United States. If you are using our website or app outside the United States, please be aware that personal information we obtain about you will be processed in the United States. The privacy and data protection laws and regulations that apply to your personal information in the United States may be different from the laws in your home country. 

We reserve the right to change this Policy at any time. We post our Policy with the date of the most recent updates.