US State Privacy Rights

Effective Date: August 1, 2025

This section generally applies to residents of Connecticut, Delaware, Iowa, or Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia (the “States”) whose personal information is subject to Colorado Privacy Act, Delaware Personal Data Privacy Act, Iowa Act Relating to Consumer Data Protection, Nebraska Data Privacy Act, New Hampshire Privacy Act, New Jersey New Jersey Data Protection Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, Privacy Statement for Utah Residents as required by the Utah Consumer Privacy Act, Virginia Residents as required by the Virginia Consumer Data Protection Act (“US State Laws”) and certain exceptions within such laws, as applicable. If you are not a resident of the above-mentioned states, the rights described in this section do not apply to you.

The provisions below supplement the information provided in the generally applicable portion of our Privacy Policy and apply solely to individuals that are residents of the States and qualify as a “Consumer”, or equivalent term under the applicable US State laws respectively. This State-specific section provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the applicable US State Laws. Terms in this section are to be understood in a manner consistent with applicable US State Laws including the definitions of such terms in the US State Laws. Such terms may have a different definition or meaning in other portions of this privacy policy because US State Laws may not apply to those sections.

CATEGORIES OF PERSONAL INFORMATION PROCESSED

Please refer to the “COLLECTION OF PERSONAL INFORMATION” section of the Privacy Policy.

PURPOSE OF PROCESSING

Please refer to the “HOW WE USE YOUR PERSONAL INFORMATION” section of the Privacy Policy.

CATEGORIES OF INFORMATION DISCLOSED & CATEGORIES OF THIRD PARTIES WITH WHICH WE SHARE

Please refer to the “DISCLOSURES OF YOUR PERSONAL INFORMATION” section of the Privacy Policy.

PRIVACY RIGHTS UNDER US STATE PRIVACY LAWS

A number of individual rights are available to individuals under the applicable US State Laws relating to personal information that we have collected (subject to certain limitations), depending on your State of residence may include:

The right to access: you have the right to confirm whether a controller is processing your personal information and to access such information.
The right to correction: you have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and purposes of the processing.
The right to deletion: you have the right to delete your personal information you have provided or that has been collected.
The right to obtain a portable copy of your personal information: you have the right to obtain a copy of your personal information that was previously provided in a portable, and to the extent technically feasible, readily usable format that can be transmitted to another entity.
The right to opt out: you have the right to opt out of (as defined by the Applicable State Law) (i) targeted advertising, (ii) the sale of personal information and (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
The right to be informed of third-party disclosures [For residents of Delaware & Oregon]: you have the right to obtain a list of specific third parties, other than natural persons, to which Toast has disclosed personal information.

INVOKE PRIVACY RIGHTS

To submit individual rights requests, please refer to the “CONTACT INFORMATION” section of the Privacy Policy. You may request access to your personal information twice in any 12-month period, measured from the date we receive your first request. If you submit a request to obtain your personal information more than twice in any 12-month period, we will either: (i) proceed with honoring your request; or (ii) deny your request in writing.

Consistent with applicable U.S. Privacy Laws and our interest in the security of your personal information, we will not deliver to you your Social Security number or other government-issued ID number, financial account number, biometric information, or an account password together with security questions or answers in response to a privacy rights request.

VERIFICATION

In order for you to exercise your privacy rights, we will need to obtain certain information from you to verify your identity. For a report of the specific personal information we have collected about you, you must provide us with three of the following pieces of information in order for us to verify your identity:

full name;
email address;
loyalty club number with our Business Customer;
zip code; or
mobile telephone number.

You also must provide us with a signed declaration, under penalty of perjury, that you are who you say you are.

For a report of the categories of personal information we have collected about you, for a request to delete your personal information, or for a request to opt out of the sale of your personal information, you must provide us with two of the above-referenced pieces of information in order for us to verify your identity.

Where necessary, we may request additional information about you so that we can verify your identity. Where we did not already hold that information, we will use it only for the purpose of verifying your identity and to process your request.

TIMING

We will respond to requests to delete and requests to access your personal information within 45 calendar days, unless we need more time, in which case we will notify you and may take up to 90 calendar days total to respond to your request. We will respond to requests to opt out of the sale of your personal information within 15 business days.

APPEALS

Residents of Virginia and Colorado may appeal our decision regarding a request by contacting us using one of the methods described in “Contact Information” below.

SALE OF PERSONAL INFORMATION

Although we do not “sell” your personal information for money, applicable US State Laws have defined “sale” to include many of the routine ways that businesses share information. As a result, some of our data sharing practices with Affiliates and Business Partners would be considered a “sale,” as defined under the applicable US State Laws. Below is a summary of the categories of personal information we have collected from consumers in the previous 12 months and the categories of third parties to whom we have shared your personal information.

*Category of Personal Information*	*Categories of Third Parties to Whom We Sold Personal Information*
Identifiers	Business Partners and other third parties within the restaurant and retail industry; Affiliates.
Commercial information	Business Partners and other third parties within the restaurant and retail industry; Affiliates.
Internet usage information	Marketing partners; Affiliates.

TARGETED ADVERTISING

PAR carries out limited targeted advertising (as that term is defined by applicable US State Laws) via cookies and other related tracking technologies. For more information, please refer to the “CHOICES ABOUT YOUR PERSONAL INFORMATION” section of the Privacy Policy and the Cookie Policy.

PROFILING

Presently, PAR does not carry out any profiling (as defined by the applicable US State Laws) in furtherance of decisions that produce legal or similarly significant effects concerning consumers that are presently in scope for the purposes of applicable US State Laws.

DEIDENTIFIED INFORMATION

We may at times receive, or process personal information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

ADDITIONAL INFORMATION FOR NEVADA RESIDENTS

Nevada residents have the right to instruct us not to “sell” “covered information” as those terms are defined by Chapter 603A of the Nevada Revised Statutes. Although we do not currently “sell” “covered information” of Nevada residents, as those terms are defined under that law, you may contact us via the “CONTACT INFORMATION” section of the Privacy Policy and provide your name, Nevada address, and email address to be verified and exercise your opt-out rights in the event we do sell covered information under that law in the future. If you change your email address or other contact information, contact us in the same manner to update your contact information to help facilitate your opt-out. Changing your contact information elsewhere (e.g., informational requests, account information, etc.) will not update your Nevada opt-out information and we will only use the information provided to our opt-out program for managing opt-outs. It is your responsibility to keep your opt-out information current. If after opting-out you direct us to share your covered information with others, we will do so regardless of your prior opt-out.

CHANGES AND UPDATES

We will update this section from time to time. When we make changes to this section, we will change the “Last updated” date at the beginning of this section. All changes shall be effective from the date of publication unless otherwise provided in the notification.

CONTACT

If you need to contact PAR, please refer to the “CONTACT INFORMATION” section on the main Privacy Policy.

Search PAR

US State Privacy Rights

Tiffany Disher