Privacy Policy

Introduction

This privacy policy for Corridor 18 ("We", "Us" or "Our") tells you how we may collect, use and share your information when you visit our website https://corridor18.com/.

We appreciate your decision to use our website https://corridor18.com/ and to trust us with your valuable personal information. In this document, we seek to explain in the clearest terms possible our privacy practices. We strongly encourage you to read this document (and any other related documents) carefully before using the website. If there are any terms or conditions in this document that you do not agree with, please do not use the website, or in case you are already using it, please discontinue the use immediately. By using the website, you are accepting and consenting to the practices described in this Privacy Policy.

What information do we collect about you?

When we collect information, we do so to ensure that you get to experience our service seamlessly. For that, we collect the following information.

The personal information that we collect about you are the following:

• Name
• Email address
• Phone number
• Message
• Guest count
• Event date

We also collect some information automatically when you use the website, through cookies and similar technologies. None of it is collected unless you allow analytics or advertising in our cookie banner — if you decline, or simply never answer the banner, none of the following is collected at all.

• Online identifiers — an analytics cookie identifier, your IP address, and information about your device and browser.
• Approximate location — a city-level estimate derived from your IP address. We do not collect precise or GPS-level location, and the site never asks your browser for it.
• Usage information — the pages you view, the site that referred you, your activity during a visit, and four specific actions: starting an order, sending a catering enquiry, sending a contact message, and signing up for the Burger Club.
• Inferred characteristics — age range, gender, and interest categories that our analytics provider derives and reports to us. These are estimates produced by that provider, not information you gave us.
• Context for those actions — which of our brand websites you are using and which restaurant location an order relates to. These describe the page and the restaurant rather than you.

How do we collect such information?

We may use any of the following three ways to get information about you.

1. The information that you give us
2. The information that we automatically collect from you
3. Information that we collect from third parties

Before going into the reasons why we collect the information that we do, we want you to understand what the above three terms mean.

a. The information that you give us

These are the information that you give us.

b. The information that we automatically collect from you

When you access our service from a device, we may automatically collect information from your device, such as through the use of cookies. You will know more about automatic collection of personal information in the next section.

c. Information that we collect from third parties

Our analytics provider derives characteristics such as age range, gender and interest categories from activity across its own services, and reports them to us alongside our own measurement. We do not buy personal information, and we do not obtain it from data brokers, data aggregators, online directories, data marketplaces or exchanges.

Cookies and similar technologies

Cookies are small packets of information that are placed on your device, so that we can retrieve the information about you, such as your choices on our websites and other information.

For more information about cookies and similar technologies, please visit our cookie policy.

Do not track requests

We respond to "do not track" requests in the following manner:

Do Not Track and Global Privacy Control

Most browsers include a "Do Not Track" (DNT) setting. No uniform standard for interpreting DNT signals has been adopted, and this website does not respond to them.

Some browsers and extensions send a Global Privacy Control (GPC) signal. Where we recognize a GPC signal, we treat it as a request to opt out of the sale and sharing of your personal information.

Analytics and advertising cookies are switched off by default on this site. Nothing optional loads until you choose it through our cookie banner, where functional, analytics, and advertising can be enabled independently.

These choices apply only to optional tracking. If you submit a contact message, catering request, or Burger Club sign-up, we process the information you provide along with limited technical data such as your IP address, used to prevent spam and abuse, record your consent, and keep the site secure. Strictly necessary cookies are unaffected.

You can also block or delete cookies in your browser, though some features may not work without strictly necessary cookies.

You can change your choices at any time using the "Cookie Settings" link in the site footer.

Why do we collect information about you?

We collect information about you for a variety of reasons. It helps us, among other things, to serve you better. The following are the ways in which we use the information that we collect about you.

• To provide and maintain service
• To contact the user
• To send marketing and promotional communications
• To evaluate and improve our products/services
• To examine the usage trends
• targeted advertising

How long do we retain your information?

We will only keep your personal information for We keep personal information only as long as we need it for the purpose it was collected, and the period differs by type:

• Contact and catering enquiries — up to 24 months after our last correspondence with you, so we can handle follow-up questions and repeat bookings. Deleted after that.
• Burger Club subscriptions — until you unsubscribe. If you unsubscribe, we keep a record of your email address so we do not email you again by mistake.
• Cookie consent records — 12 months, after which we ask you again.
• Website analytics — retained by our analytics provider on our behalf for up to 14 months.
• Server and security logs — a short period, typically no more than 30 days, for troubleshooting and abuse prevention.

Where we are required to keep information longer to comply with a legal obligation, we keep it for that period and no longer., unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Do we share your information?

We may share your information with third parties in the following ways:

1. Sharing with your consent: When you give consent, we may share your information with third parties for the purposes that are mentioned in the consent notification.
2. Legal Obligations: We may disclose information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).
3. For business transfers: We may share your personal information in connection with, or during the course of negotiations regarding merger, sale of business assets, financing or acquisition of all or a part of our business by another entity.

Sale/sharing of information

The categories of personal information that are sold or shared with third parties are as follows:

**Sold: none.** No personal information is sold — no money or other valuable consideration changes hands.

**Shared** (cross-context behavioral advertising) — Google Signals only, mirroring consented GA4 data to Google LLC for advertising and audience building:

| Category | What it is here |

| **Identifiers** §1798.140(v)(1)(A) | Online only: GA4 client ID (`_ga`), IP, device/browser identifiers |

| **Internet/network activity** (F) | Pages viewed, referrer, session data, and four events: `begin_order`, `generate_lead`, `sign_up`, `contact_submit` |

| **Inferences** (K) | Age range, gender, affinity/in-market segments Google derives |

| **Geolocation** (G) | City-level only, derived from IP address. Not precise geolocation |

**Not sold or shared.** The contact form (name, email, message), catering form (name, email, phone, party size, details), and Burger Club (email) go to Resend — service provider, business purpose. Nothing from these reaches analytics. Also none: payment information (no cart or checkout; ordering is on Toast's domain) and sensitive personal information.

The categories of third parties to whom the information is disclosed are as follows:

**One third party: Google LLC** — the same recipient for all four categories.

| Category shared | Category of third party | Named |

| Identifiers | Advertising networks / digital advertising platforms | Google LLC |

| Internet or other network activity | Advertising networks / digital advertising platforms | Google LLC |

| Inferences | Advertising networks / digital advertising platforms | Google LLC |

| Geolocation | Advertising networks / digital advertising platforms | Google LLC |

Google is a **third party** here rather than a service provider precisely because Google Signals lets Google use the data for its own advertising purposes. That is what makes this a "share" at all — GA4 used purely for your own measurement, with Signals off, would be a service-provider relationship and would not appear in this section.

Review and change information

The user has the right to review and change their information by:

How to review, update, or delete your information

You can ask us at any time to confirm what personal information we hold about you, to provide a copy of it, to correct it if it is inaccurate, or to delete it.

To make a request, email info@corridor18.com and tell us what you would like us to do. Because we need to be sure we are not disclosing your information to someone else, we may ask you to confirm details that match the information we already hold — for example, the email address you used when you contacted us. We will not ask for more information than we need to verify who you are.

We respond within one month of receiving a request, or within 45 days for requests made under California law. If a request is unusually complex we may need longer, in which case we will tell you before the deadline and explain why. Making a request is free, and we will never treat you differently for having made one.

Some things you can do yourself, without contacting us:

• Burger Club — every message we send includes an unsubscribe link that removes you immediately.
• Cookies and tracking — use the "Cookie Settings" link in the site footer to change what you have allowed, or to withdraw consent entirely.

If someone is making a request on your behalf, they will need to provide proof that you have authorized them to act for you.

GDPR Disclosures

Cross border data transfer

The information that we collect from you, including your personal data, may be processed in locations outside the European Union, where data transfer laws may differ from those in effect in your jurisdiction. In some cases, the transfer may be to countries classified as 'adequate countries' by the European Union (see here for details on adequate countries). However, where the transfer is not to an adequate country, we have implemented appropriate legal measures in accordance with the General Data Protection Regulation to ensure that your personal information is adequately protected.

Standard Contractual Clauses: When we transfer the data collected from you, including personal data, to third countries that are not deemed adequate, we have agreements in place with processors in those countries that include the Standard Contractual Clauses mandated by the GDPR. For more information on Standard Contractual Clauses, please see here.

Where international data transfers are not to an adequate country, the following precautions have been taken to ensure the safety of your personal data.

All processing happens in the United States. Every vendor in the stack — Vercel, Resend, Upstash, Cloudflare, Sentry, Google, CookieYes — is US-based or stores data in US regions. The business itself is a single Los Angeles restaurant with no EU establishment.

The US is not adequate as a whole. It is conditionally adequate under the EU–US Data Privacy Framework, and only for organizations that have self-certified to it.

Automatic processing of data

We do not use any automated processing of the personal information we collect.

Legal basis for the collection

The General Data Protection Regulation requires us to identify and set out the legal basis, or in other words, the legal justification, for processing your personal information. The following are the legal bases on which we process your personal data.

Consent: We may process your personal information for the purposes described in this Privacy Policy with your consent.

Legal obligations: We may disclose information where we are legally required to do so to comply with applicable laws, governmental requests, judicial proceedings, court orders, or legal processes, such as responding to a court order or a subpoena (including requests from public authorities to meet national security or law enforcement requirements).

Legitimate interests: We may process your personal data where it is reasonably necessary to achieve our legitimate business interests.

We rely on our legitimate interests for a limited set of purposes: keeping this website and its forms secure; preventing spam, bot submissions, and abuse of our contact, catering, and email sign-up forms; responding to enquiries you send us; and diagnosing technical problems so the site continues to work. For these purposes we process limited technical information, such as your IP address and details of your request. We have considered these interests against your rights and freedoms, and we do not use this basis for analytics or advertising, which rely on your consent.

Your rights

In accordance with Articles 12 to 23 of the General Data Protection Regulation, the data subject, that is you, has the following rights.

1. Right to object to the processing of personal data in certain circumstances. See here for details.
2. Right to request access to the data we have collected about you and to receive a copy of it in an accessible format.
3. Right to restrict the processing of your personal data for a limited period, under certain circumstances. See here for details.
4. Right to rectify or modify personal information that you consider obsolete, incomplete, or inaccurate.
5. Right to opt out of automated processing of your personal data.
6. Right to erasure of your personal information, also known as the right to be forgotten.

To exercise any of the rights mentioned above, you may use the contact details provided in this Privacy Policy.

Privacy of children

We do not knowingly provide our services to children. If you are a parent or legal guardian and believe that your child has provided us with information without your consent, please contact us. Upon verification that we have collected such information without parental consent, we will remove the information from our database.

Security of your personal information

We take reasonable measures to ensure that the information we collect from you is stored securely and protected to the best extent possible. However, no method of internet transmission or digital storage is completely secure, and we cannot guarantee absolute security. While we use commercially reasonable and appropriate security measures to protect your information, we cannot promise that it will be 100% secure.

Links to other websites or apps

On our website, we may provide links to external websites, apps, or services. These are not operated by us and therefore are not governed by our Privacy Policy or practices. We strongly recommend that you review the privacy policies of such websites or services before engaging with them to ensure that you do not provide personal information that you do not wish to share.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in the law or our privacy practices. We recommend that you review this privacy policy periodically to ensure it remains in line with your expectations.

The privacy policy will be effective from the date it is posted on this page.

Contact us

For any questions or concerns regarding your privacy, or to exercise any of your rights, you may contact us using the following details:

Controller/representative: Corridor 18 LLC 8532 W Pico Blvd, Los Angeles, CA 90035, USA Email: info@corridor18.com Phone: +1 310-507-7166

Address: Corridor 18 LLC 8532 W. Pico Blvd. Los Angeles, CA 90035 USA

Email address: info@corridor18.com

Link to our contact page: https://corridor18.com/contact