Last Updated: October 15, 2025

CMG Strategy Co., LLC and its subsidiaries and affiliates (collectively, “we”, “us”, or “Chipotle”) provide this Applicant Privacy Notice applicable to users of our Careers site. Because we gather certain types of information about applicants during the recruitment process, we want to help you understand our practices surrounding the collection, use and disclosure of your personal information.

Para ver este aviso en Español, haga clic aquí.

Veuillez cliquer ici pour consulter cet Avis en français.

Um diese Mitteilung auf Deutsch zu lesen, klicken Sie hier.

As a food-focused, people-first company, our mission of Cultivating a Better World means more than just using real ingredients. It means hiring passionate people and investing in their future. It means championing diversity and celebrating inclusion. It means fostering a culture of well-being for our employees and the environment. So whether you are seeking to join our team to grow your career, chase your passion or just pick up a few skills along the way, we want to help you get a real start.

This Privacy Notice addresses the following topics:

·      Scope of This Notice

·      Your Consent

·      Personal Information We Collect About You

·      Information About Protected Classification

·      Categories of Sensitive Personal Information Collected or Collected

·      Categories of Sources of Your Personal Information

·      How We May Use Your Personal Information

·      Other Basis for the Disclosure of Your Personal Information

·      Do We Sell Your Information

·      Notice of Right to Opt-Out of the Selling and Sharing of Your Personal Information

·      Opt -Out Preference Signals

·      Internal References

·      Internet Based Advertising – Cookies, Pixels, and Trackers – Your Choices

·      Retention of Your Personal Information

·      Security For Your Personal Information

·      Jurisdiction-Specific Information

·      Changes to this Notice

·      Inquiries and Concerns

Scope of This Notice

This Privacy Notice applies only to information collected for recruitment purposes through the Site—inclusive of our chat bot and virtual team member, Ava Cado—and from other sources. The other sources might include information that you provide other than through the online application page or our virtual team member, as well as information obtained, for example, from prior employers, other references, pre-employment screening providers, and educational institutions. This Notice does not apply to personal information about our employees, contractors, customers, or to other personal information that Chipotle collects for other purposes, which is subject to separate privacy policies.

Your Consent

Creating an Account

To submit your job application for most roles within Chipotle, you will be required first to create an account with us. After providing the required account information, you will need to review and acknowledge that you have read our Chipotle Applicant Privacy Notice: “By clicking the “Create Account” button below, I acknowledge that I have reviewed, understand and agree to Chipotle’s Global Applicant Privacy Notice." By clicking “Create Account”, you consent to the collection, use, disclosure, transfer across borders and other processing of your personal information as described below. Once you agree, your consent will continue to apply to our collection, use, disclosure, cross-border transfer and other processing of your personal information unless you revoke your consent by contacting us at privacy@chipotle.com.

If you click "Decline," you will not be able to proceed to the online application page to apply for global career opportunities within Chipotle, and Chipotle may not be able to consider you for the position for which you wish to apply.

Engaging with our Chat Bot and Virtual Team Member, Ava Cado

If you choose to engage with our chat bot and virtual team member, Ava Cado, you will also be asked to consent to the collection, use, disclosure and transfer across borders or other processing of your personal data. We may record or create transcripts of your chats with Ava Cado, or any other method by which you connect with us and may retain the information disclosed during these interactions to assist you in the future, to improve our recruiting process, to meet our legal obligations or to protect our legal interests, as well as for other business purposes that are detailed in this Notice. We may also use vendors to provide these services which means these vendors may have to access to these recordings or transcripts, including in real time. By using Ava Cado, you consent to Chipotle’s monitoring and recording of the chat and to the collection and analysis of all personal information provided through the chat, and you authorize Chipotle to disclose to and share with our service provider any personal information you provide. If you do not consent to Chipotle’s collection and analysis of your data or to the processing of this data by our service provider on Chipotle’s behalf, then please do not use Ava Cado.

Mobile Terms

The Ava Cado short code program (“Ava Cado”) is used to communicate with job candidates, applicants, and employees about recruitment and employment related inquiries via SMS. Users can opt-in by selecting “email and text message” as their preferred communication method during the application process, or texting the advertised keyword to “CHIPJOBS” or “21414”. If you sign up to receive communications via text messages, you consent to Chipotle or its designated agents sending you automated SMS messages. You can opt out at any time.

Once you have opted-in to Ava Cado, you can opt-out or cancel SMS messages from Ava Cado at any time by texting “STOP” to “CHIPJOBS” or “21414”. After you text “STOP” to “CHIPJOBS” or “21414” you will receive one additional SMS message to confirm that you have been unsubscribed. If you would like to join or opt-in again, you can sign back up for Ava Cado by texting the advertised keyword to “CHIPJOBS” or “21414”and you will start receiving SMS messages from Ava Cado again.

If you experience issues with Ava Cado you can respond to a message from Ava Cado with the word “HELP” or text “HELP” to “CHIPJOBS” or “21414” for assistance. You may also contact us for help at privacy@chipotle.com.

Carriers are not liable for delayed or undelivered messages. Message and standard message and data rates may apply for any messages sent to you from Ava Cado, and to Ava Cado from you. Message frequency varies. If you have any questions about your text plan or data plan, please contact your wireless provider.

Personal Information We Collect About You

When you apply for a position or interact with us regarding potential job openings, we may collect Personal Information from you in a variety of different situations and using a variety of different methods, including, but not limited to, on our website, your mobile device, through email, in physical locations, through written applications, through the mail, and/or over the telephone. Generally, we may collect, and we have in the last 12 months collected, the following categories of personal information from or about job applicants. For each category of information, we identify below the categories of third parties, service providers, and contractors to whom we have disclosed the information in the last 12 months. The examples provided for each category are not intended to be an exhaustive list or an indication of all specific pieces of information we collect from or about you in each category, but rather the examples are to provide you a meaningful understanding of the types of information that may be collected within each category.

Information About Protected Classification

When you apply for a position, you may have the opportunity to provide information about your protected classification, i.e., gender, race/ethnic origin and/or veteran status in order for us to conduct equal opportunity monitoring to the extent permitted by applicable laws. The provision of this information is entirely voluntary. If you decline to provide this information, your application(s) will not be affected in any way. If you do choose to provide this information, you consent to our using it for equal employment opportunity monitoring purposes. This information will be held and stored anonymously and will not be used to evaluate your application for employment and also will not be used to infer any characteristics about you.

Except as described above, we will not request or otherwise collect information about your health, race or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or sexual orientation or your genetic information or biometric information through the online application or during the application process unless the law, as an exception, requires us to do so. We, or a third-party background check company under our direction, may check employment references, and criminal history records for information about convictions, but only if and to the extent permitted by applicable law.

Categories of Sensitive Personal Information Collected or Processed

Of the above categories of Personal Information, the following are categories of Sensitive Personal Information the Company may collect from or about consumers:

1.     Account Information (your Company account log-in, in combination with any required security or access code, password, or credentials allowing access to the account)

2.     Protected Classifications if you provide it as explained above (racial or ethnic origin, religious or philosophical beliefs, union membership, or sexual orientation)

3.     Geolocation Data (IP address and/or GPS location, latitude & longitude)

4.     Medical and Health Information

Personal information does not include:

·      Publicly available information from government records.

·      Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer, independent contractor, or applicant, or from widely distributed media.

·      Information made available by a person to whom the consumer, independent contractor, or applicant has disclosed the information if the consumer, independent contractor, or applicant has not restricted the information to a specific audience.

·      Deidentified or aggregated information.

Categories of Sources of Your Personal Information

We may collect the categories of personal information listed above from the following sources:

·      You, for example, in your job application, forms you fill out for us, assessments you complete, surveys you complete, and any information you provide us during the course of your application and interview process, including when you use our Chat Bot, Ava Cado.

·      Vendors and service providers, for example, recruiters.

·      Third parties, for example, job references, affiliated companies, professional employer organizations or staffing agencies.

·      Public internet sources, for example, social media, job boards, public profiles, and other public online sources. Note that your use of such platforms and the handling of your Personal Information is governed by those platforms’ terms of use and their privacy policies. When we receive your Personal Information as part of your application to Chipotle, our own handling of your Personal Information will follow this Notice.

·      Public records, for example, court records, and credentialing and licensing organizations.

·      Automated technologies on Chipotle’s electronic resources, for example, to track logins and activity on Chipotle’s careers page.

·      Surveillance/recording technologies, for example, video surveillance in common areas of Chipotle facilities, voicemail technologies, webcams, and audio/video recording technologies with consent to the extent required by law.

·      Government or administrative agencies, for example, law enforcement or public health authorities.

·      Our employees, contractors, vendors, and suppliers, for example in the event of a referral or recommendation.

·      Our affiliated entities, including parent entities, subsidiaries, and affiliated entities

How We May Use Your Personal Information

We will use the information that we collect about you for purposes of the hiring process, including:

Recruiting Purposes:

·      To evaluate your qualifications or suitability for employment with us

·      To communicate with you

·      To check your references

·      To conduct a pre-employment or criminal history background check

·      For identification purposes

·      For diversity and inclusion purposes where permitted by applicable law

·      For recordkeeping purposes

·      To demonstrate your agreement to, or acceptance of, documents presented to you, (e.g., pre-employment arbitration agreement, acknowledgment of employment application, offer letter)

·      To evaluate and improve the recruiting process

If you visit our facilities:

·      To make travel arrangements

·      To reimburse travel expenses

·      To manage access to Chipotle facilities

·      To maintain security during the visit

·      To monitor your use of the corporate Internet access if you connect to our guest WiFi, or your use of other Chipotle systems

Other Purposes to Conduct Our Business

• To manage and operate information technology and communications systems, risk management and insurance functions, budgeting, financial management and reporting, strategic planning
• To provide you with information about our company through marketing communications
• To exercise our rights under applicable laws, and to support or defend against administrative charges or legal claims
• To comply with our legal and regulatory obligations
• In connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of Chipotle or any of its subsidiaries or affiliates;
• To protect the rights, property, or safety of Chipotle, applicants, our customers, or others

You may also choose to receive job posting notifications by email or text message, informing you of positions that may fit your profile. You can stop receiving job alerts by email at any time by following the “unsubscribe” instructions included in each email or replying STOP to any text message.

Chipotle’s employees involved in the evaluation of your application and, if you are hired, in the administration of your employment relationship with Chipotle will have access to your personal information on a need–to-know basis.

Lawful Basis For Processing: Where applicable information protection law requires a lawful basis for collecting, using and otherwise processing your personal information, Chipotle relies on your consent to do so. The processing of your personal information also is necessary for Chipotle to determine whether to enter into an employment agreement with you. If you do not provide requested information, Chipotle may not be able to consider you for employment. In addition, the processing of your personal information is necessary for Chipotle to pursue its legitimate interests in recruiting and hiring suitable personnel.

To Whom We Disclose Personal Information

We may disclose, sell, or chare your personal information to/with the following categories of service providers, contractors, or third parties:

·      Government agencies

·      Talent acquisition management systems

·      Vendors providing services for purposes of our human resources information system (HRIS) and management of job applicant data and recruiting process

·      Communication providers/vendors that facilitate, manage, and send/receive communications on our behalf via email, or text/SMS, phone

·      Recruiting and staffing firms or agencies 

·      Social media platforms

·      Data analytics vendors

·      Marketing tracking and retargeting vendors and vendors that support managing or hosting the website and the Chat function on the website

·      Video content hosts and providers

·      Consulting and investigation firms, including HR consultants, safety consultants, and workplace investigators

·      Security and risk management vendors, including IT, cybersecurity, and privacy vendors and consultants

·      Our affiliated entities, including parent entities and subsidiaries

Other Basis for   the Disclosure of Your Personal Information

There are limited circumstances when Chipotle may disclose the personal information we collect about you to third parties, most notably:

·      Service Providers: With third-party service providers. We may, for example, retain a service provider to host all or portions of this Site, to help maintain and manage our databases, to assist in the recruiting process, or to conduct pre-employment screening. Service providers will be permitted to use your personal information only for the purpose(s) for which it was disclosed to them and in accordance with Chipotle’s instructions. Service providers generally will be located only in the United States or in the country where you are applying for a position;

·      Required By Law: When required by law, such as when we respond to subpoenas, court orders, legal process, or a discovery request in civil litigation;

·      Legal Violations: If we believe that your actions violate applicable law, or threaten the rights, property, or safety of our Company, our users, or others;

·      Corporate Transactions: If we sell some or all of our business, we may disclose all of the information that we have collected about you to a purchaser or, in due diligence, to a potential purchaser, but subject to a confidentiality agreement.

Chipotle will make such disclosures only as permitted by applicable information protection laws.

Do We Sell Your Information?

We do NOT and will not sell or share your personal information in exchange for monetary consideration. However, we may sell or share some of your information to third parties for other valuable consideration, as noted in the table above.

We may sell or share your personal information for the following business or commercial purposes:

1.     For marketing activities, including targeting and retargeting our ads and our affiliates’ ads based on your activity on our websites

2.     To improve user experience

3.     To understand the demographics of our website users and receive reports on website traffic

Other than these exceptions, we do not and will not disclose your personal information to any third party in exchange for monetary or other valuable consideration or share your personal information for cross-context behavioral advertising.

Notice of Right to Opt-Out of the Selling and Sharing of Your Information

• Depending on the state where you reside, you may have the right to tell us NOT to sell or share your personal information. You have the full and free right to opt-out of our disclosure of your personal information to any third parties where the disclosure constitutes “selling” or “sharing” as defines by specific state laws. You may exercise your right to opt-out without fear of discrimination for doing so. To opt-out of our selling and sharing of your information, meaning we will not disclose your information to third parties for any monetary or other valuable consideration, you can do any of the following:
  •  Click on Your Privacy Choices  in our Website footer and either toggling off Non Essential Targeting, Social Media, Analytics, & Functional Cookies or clicking “Reject All” and then clicking “Save choices.”  Completing this step will opt out you out of targeted advertising or the “sale” or “sharing” facilitated through web-initiated device tracking.   
  • Complete and submit a Data Request Form. Completing this step will opt you out of targeted advertising for the “sale” or “sharing” or your personal information directly with third parties; or
  • Contact us by phone at 833-506-0473 to make a general request.

·      We honor the following universal opt out mechanism: Global Privacy Control supported by Take Control Of Your Privacy. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. You may need to repeat the preference options described above from each device and browser that you use in connection with our Service, as well as in a particular browser or device if you clear cookies or reset the browser. 

You can have an authorized agent submit a request on your behalf. To submit an opt-out through use of an authorized agent, you must provide that agent with written permission signed by you to submit an opt-out on your behalf, except when using an opt-out preference signal. The authorized agent may call our toll-free privacy line at 833-506-0473 to make the opt-out request and for directions for submitting the proof of authorization and the authorized agent’s proof of identification to the Company. We maintain the right to deny any request from an authorized agent that does not submit sufficient proof that they have been authorized by you to act on your behalf.

A request to opt-out need not be a verifiable consumer request. However, we may deny a request to opt-out if we have a good faith, reasonable, and documented belief that a request to opt-out is fraudulent. If we deny your request to opt-out, we shall inform you of our decision not to comply and provide an explanation as to why we believe the request is fraudulent.

Opt-Out Preference Signals

Opt-out preference signals provide consumers with a simple and easy-to-use method by which to exercise the right to opt-out of the selling and sharing of their information. Global Privacy Controls (GPC) or Universal Opt-Out Mechanism (UOOM) are user-enabled opt-out preference signals which can communicate a user’s “Do Not Sell or Share” request on behalf of the person or device. We will process opt-out preferences from GPC and UOOM signals which are in formats commonly used and recognized by businesses, such as an HTTP field header. We will treat a consumer’s use of GPCs or UOOMs as a valid request to opt-out of the selling and sharing of information for that browser. We currently do not connect browser use to particular consumers and, as such, you will need to use GPCs or UOOMs on all browsers in which you access our website and use our opt-out form to opt-out of offline sales.

Do Not Track (DNT) is a privacy preference that users can set if they do not want web services to collect information about their online activity. We do not respond to DNT signals or other mechanisms (with the exception of GPCs and UOOMs) that provide a choice regarding the collection of personal information about activities over time and across different websites or online services. We encourage users who have DNTs to use GPCs or UOOMs.

Internal References

As part of our application process, you are given the opportunity to provide the name of any Chipotle employee who referred you to apply for the position for which you are submitting an application through this Site. You are not required to provide an employee reference. If you do submit the name of an internal reference Chipotle will ask that employee: (1) if they referred you to apply; and (2) if they endorse your application. By submitting the name of an internal reference you are confirming that you have received the explicit consent of the Chipotle employee to submit their personal information.

Retention of Your Personal Information

If Chipotle hires you, the information that you submitted through the online application and the information that we collect during the application process will become part of your personnel file and may be used to administer the employment relationship and for related reporting and recordkeeping purposes. Chipotle will retain this information for the entire duration of your employment relationship with Chipotle and for the period thereafter identified in Chipotle’s Global Records Retention Schedule, which is available on Chipotle’s corporate intranet.

Chipotle will retain the information of applicants who are not hired for one year after the hiring decision has been made unless (a) the applicant indicates that we may maintain the information on file until the applicant asks to delete the information, or (b) a shorter or longer retention period is legally required. These records will be retained for our internal recordkeeping and reporting purposes. During that time, we may use your personal information to consider you for positions in addition to the position(s) for which you initially applied. If you wish to withdraw your application from consideration at any time during this retention period, you may delete your application through the Candidate Home page or engage with Ava Cado and request that your application be withdrawn.

Internet-Based Advertising – Cookies, Pixels and Trackers – Your Choices

Our Website may store or retrieve information on your browser, mostly in the form of cookies. A cookie is a small piece of data (text file) that a website – when visited by a user – places on the user’s device to remember information about the user, such as the user’s language preference or login information. This type of cookie is set by us and is referred to as a “first-party cookies.” Chipotle uses first-party cookies primarily to make the Website work as you expect it to. For example, we use the information we collect through first-party cookies to allow you to navigate between pages efficiently, analyze how well our Website is performing, and understand the content that you spent the most time reviewing. In some cases, we use first-party cookies to store information that we use for targeted advertising.

We also incorporate cookies and similar technologies, such as pixels, tags, and web beacons, from outside Chipotle’s domain (“third-party cookies”). Third-party cookies gather information to enable our vendors to provide a range of services to us, including targeted advertising and measuring the success of our advertising campaigns. 

Additionally, Chipotle engages service providers to host and manage certain pages of its website. These service providers may use cookies that differ from those on webpages hosted and managed by Chipotle. This means that you may be presented with additional opportunities to opt out of targeted advertising and / or the “sale” or “sharing” of your personal information when navigating between pages on Chipotle’s website or application.

Please review our Cookie Policy for a detailed list of the categories of first and third-party cookies we use on our Website and additional information related to your ability to control cookies on Webpages and Apps hosted and managed by us. You can prevent the collection of data by Non-Essential Targeting, Social Media, Analytics & Functional Cookies by clicking on Your Privacy Choices  in our Website footer and toggling off the related functionality. 

We honor the following universal opt out mechanism: Global Privacy Control supported by Take Control Of Your Privacy. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs.

You may need to repeat the preference options described above from each device and browser that you use in connection with our Service, as well as in a particular browser or device if you clear cookies or reset the browser. Security For Your Personal Information

We want you to feel confident about providing your personal information through the online application page, so we have implemented a security program to keep information that is transmitted to our systems protected from unauthorized access. Your submissions of information to our secure server are protected by Hypertext Transfer Protocol Secure (“HTTPS”) and Transport Layer Security (TLS) technology, utilized by many popular browsers to safeguard transmissions. This technology allows us to use encryption tools to protect information transmitted between your computer and our server. After we have received your information, access to it is limited to employees with a need to know.

While we strive to protect your personal information, we cannot guarantee the security of any information that you submit through the online application, and you do so at your own risk. We urge you to keep your username, password and any other log-in credentials in a safe place as you share responsibility for maintaining the confidentiality of the information that you submit to us. It is a good practice to sign off your account and close your browser window when you have finished your visit to the Site.

Jurisdiction-Specific Information

·      California

·      European Economic Area, and United Kingdom

·      Canada

California

This section applies only to individuals who reside in the state of California in the United States (“California residents”). This section applies to personal information collected through Site and in any other way, such as when California residents visit our offices.

California Notice at Collection: Chipotle collects the categories of personal information identified in the section on “ Personal Information We Collect About You” above, for the purposes identified in the section “How We May Use Your Personal Information” above, and retains personal information for the period described in the section on “Retention of Your Personal Information”.

Additional Information Regarding Disclosures of Personal Information

The California Privacy Rights Act (CPRA) requires that we provide you with the following information about disclosures of your personal information to third parties for “business purposes”, as that term is defined in the CPRA:

·      Service providers: Chipotle may disclose to service providers any of the categories of personal information listed in the section on “Categories of Sources of Your Personal Information,” above, for the business purpose of performing services on Chipotle’s behalf and, in particular, for the specific purposes described in “How We May Use Your Personal Information”, above.

·      Auditors, lawyers, consultants, and accountants engaged by Chipotle: Chipotle may disclose the categories of personal information listed in the section on “Categories of Sources of Your Personal Information”, above, to these services providers or contractors for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on Chipotle’s behalf.

·      Affiliated companies: Chipotle may disclose any of the categories of personal information listed in the section on “Categories of Sources of Your Personal Information”, above, to other companies within the Chipotle family of companies for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

Your California Privacy Rights

Subject to applicable exceptions, California residents have the following rights under the California Privacy Rights Act (“CPRA”):

●      Right to Know: You have the right to submit a verifiable request for specific pieces of your personal information obtained from you and for information about Chipotle’s collection, use, and disclosure of categories of your personal information.

●      Right to Access: The right to request that we provide you access to or disclose to you the specific pieces of Personal Information we have collected about you;

●      Right to Delete: You have the right to submit a verifiable request to delete personal information that Chipotle has collected from or about you.

●      Right to Correct: You have the right to submit a verifiable request to correct inaccurate personal information about you maintained by Chipotle, taking into account the nature of the personal information and the purposes of processing the personal information.

We do NOT and will not use or disclose your sensitive personal information for any purposes that give rise to a right to limit the use or disclosure of your sensitive personal information under the California Consumer Privacy Act (CCPA), if it applies and you are a California resident.

Non-Discrimination: Chipotle will not unlawfully discriminate against you for exercising your privacy rights under the California Privacy Rights Act.

How to Exercise Your California Privacy Rights

Chipotle will respond to request to know, access, delete, and correct in accordance with applicable law if it can verify the identity of the requestor. You can exercise these rights in the following ways:

●      Call 833-506-0473

●      Email: privacy@chipotle.com; and

●      By completing our Data Request Form.

How We Will Verify Your Request

The processes that we follow to verify your identity when you make a request to know, access, correct, or delete are described below. The relevant process depends on how and why the request is submitted.

For a general request, such as a request to know how we handle your personal information, we will match at least two information points that you provide against information about you that we already have in our records and that we have determined to be reliable for purposes of verifying your identity.

For an escalated request, such as a request for specific pieces of your personal information, we will match at least three information points that you provide against information that we already have about you in our records and that we have determined to be reliable for purposes of verifying your identity.

We have implemented the following additional procedures when verifying the identity of requestors:

1. If we cannot verify your identity based on the processes described above, we may ask you for additional verification information. If we do so, we will not use that information for any purpose other than verification.
2. If we cannot verify your identity to a sufficient level of certainty to respond to your request, we will let you know promptly and explain why we cannot verify your identity.

Note on Deidentified Information

At times, Chipotle converts personal information into deidentified information using reasonable measures to ensure that the deidentified information cannot be associated with the individual (“Deidentified Information”). Chipotle maintains Deidentified Information in a deidentified form and does not attempt to reidentify it, except that Chipotle may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes ensure that the information cannot be associated with the individual. Chipotle prohibits vendors, by contract, from attempting to reidentify Chipotle’s Deidentified Information.

European Economic Area, and the United Kingdom

The information in this section applies to applicants who reside in the European Economic Area (EEA), and the United Kingdom (UK) (collectively, “Europe”). Individuals in Europe are not required by statute or by contract to provide any personal information to the Site.

The data controller of your personal information is the Chipotle corporate group member to which you are applying for employment. You can identify your controller and its contact details via the Chipotle name provided on the application process, or by emailing privacy@chipotle.com.

Your Additional Rights

To the extent provided by applicable law and subject to any relevant exceptions, you have the following rights.

·      Access: The right to request access to your personal information maintained by Chipotle.

o   More on the right of access: The right to access your personal information includes the right to receive a copy of all, or a portion, of their personal information in Chipotle’s possession as long as Chipotle’s providing the personal information would not adversely affect the rights and freedoms of others.

·      Rectification: The right to request that Chipotle update or correct your personal information that is outdated or inaccurate.

·      Deletion: The right to request that Chipotle to delete/erase your personal information.

·      Restrict Processing: The right to request restriction of processing of your personal information in certain situations, such as while a dispute concerning the accuracy of personal information is being resolved.

·      Withdraw Consent: The right to withdraw your consent to the processing of your personal information, at any time, where you previously consented to the processing of your personal information.

•  
  • More on the right to withdraw consent: Any withdrawal shall not affect the lawfulness of processing based on your consent before its withdrawal, and Chipotle will continue to retain the personal information that you provided us before you withdrew your consent for as long as allowed or required by applicable law.

●     Data Portability: You have the right to request that Chipotle transfer your personal information to a third party.

o   More on the right to information portability: Subject to certain limitations, the right to information portability allows you to obtain from Chipotle, or to ask Chipotle to send to a third party, a copy of your personal information in electronic form that you provided to Chipotle in connection with your interactions with Chipotle.

●     Objection: You have the right to object to the processing of your personal information.

o   More on the right to object: You have the right to object when processing of your personal information is based solely on Chipotle’s legitimate interests. If you do object in these circumstances, the processing of your personal information will be stopped unless there is an overriding, compelling reason to continue the processing or the processing is necessary to establish, pursue or defend legal claims.

●     Right to Lodge a Complaint: If you believe that your personal information has been processed in violation of applicable information protection law, you have the right to lodge a complaint with the competent supervisory authority in the country where you reside, where you work, or where the alleged violation occurred.

o   Individuals who reside in the European Union can find their competent supervisory authority here.

o   Individuals who reside in the UK can find their competent supervisory authority here.

How To Exercise Your Rights

Chipotle will respond to requests to exercise individual data rights in accordance with applicable law. To request to exercise your data rights, you can contact us as follows:

·      By Email: privacy@chipotle.com

·      By mail in the EEA:

Chipotle Mexican Grill France SAS

6 place de la Madeleine

75008 Paris

France

·      By mail in the United Kingdom:

Chipotle Mexican Grill UK Ltd.

2nd Floor, 39-41 Shelton Street,

London, WC2H 9HJ

Canada

The information in this section applies to applicants who reside in Canada.

Consent

We only collect information by lawful means. When we collect, use or share your personal information, we will do so with your consent for the purposes identified or as otherwise permitted or required by law. In compliance with our privacy obligations, we may obtain your permission based on implied consent (including through this privacy policy) or through other means (such as express consent). However, in some situations, the law allows us to collect, use or disclose personal information without your consent. You can withdraw your consent to the collection, use or disclosure of your personal information at any time; for more information see the “Your Additional Rights” section below.

Your Additional Rights

To the extent provided by applicable law and subject to any relevant exceptions, you have the following rights.

●     Access: The right to request access to your personal information maintained by Chipotle.

o   More on the right of access: Much of the information we hold about you is accessible via your account. If you’d like a copy of other information we may hold about you, you can submit a request to us by using the contact details below. Please supply as much information as possible to help us to locate your information, including the email address associated with your account.

●     Correction: The right to request that Chipotle update or correct your personal information that is outdated or inaccurate.

●     Withdraw Consent: The right to withdraw your consent to the processing of your personal information, at any time, where you previously consented to the processing of your personal information. However, depending on the request to withdraw your consent, this may mean that we will no longer be able to consider you as a candidate or move your candidacy further through the recruitment process.

o   More on the right to withdraw consent: Any withdrawal shall not affect the lawfulness of processing based on your consent before its withdrawal, and Chipotle will continue to retain the personal information that you provided us before you withdrew your consent for as long as allowed or required by applicable law.

●     Right to Lodge a Complaint: If you believe that your personal information has been processed in violation of applicable information protection law, you have the right to lodge a complaint with the competent supervisory authority in the country where you reside, or where the alleged violation occurred.

o   Individuals who reside in Canada, you have a right to lodge a complaint with the Office of the Privacy Commissioner of Canada or, if you reside in Alberta or British Columbia, the Office of the Information and Privacy Commissioner in your province.

Under specific circumstance, these rights may be limited. For example, if fulfilling your access request reveals personal information about another individual, we may not be able provide you with access to that information. If there is an exception to fulfilling your request, we will communicate clearly and fully with you about the reason.

Your privacy rights may vary depending on where you reside. If you have any questions about the specific rights provided to you pursuant to applicable law, please contact us using the information outlined below.

How To Exercise Your Rights, Make Inquiries or File a Privacy Complaint

Chipotle will respond to requests to exercise individual data rights in accordance with applicable law. To request to exercise your data rights, make inquiries regarding our privacy practices or to if you have a privacy complaint , you can contact our Privacy Officer:

·      By Email: privacy@chipotle.com

By mail in Canada:Chipotle Mexican Grill Canada Corp.

Attn: Privacy Officer

100 University Ave, 5^th Floor

Toronto, ON

M5J 1V6

International Transfer of Your Personal Information

We are headquartered in the United States, but we are a global business with subsidiaries and affiliates, restaurants and personnel located in Canada, the UK, and countries in the EEA. If you are applying for a position with us from outside the U.S., the personal information that we collect about you in the recruitment process will be transferred to, and stored on, our servers located in the U.S. and Canada, and on servers maintained by our recruitment service providers which may result in the international transfer of your data. Authorized employees of Chipotle and/or affiliated entities at locations outside the United States may have access to your personal information as part of the recruitment process. These employees may use and disclose your personal information only for recruitment purposes and must handle that information in accordance with this Privacy Notice and applicable information protection laws and guidance. The information protection laws where these companies are located may be less stringent than the laws of your home country. Contact details of the Chipotle group entities that may access your personal information can be obtained by emailing privacy@chipotle.com.

EU/ UK Applicants: We have taken steps to ensure an adequate level of protection for your transferred personal information, including through contractual clauses approved by the applicable data protection authority (the “SCCs”) to which Chipotle has entered into with its subsidiaries and affiliates, and service providers described above. You may obtain a copy of any relevant SCCs by submitting a request to privacy@chipotle.com.

Changes to This Notice

Chipotle may change this Privacy Notice from time to time in its sole discretion. If we make a material change to this Notice, we will inform you by posting a notice on the Site. Those changes will go into effect on the effective date posted in the revised notice. The new policy will apply to all current and past users of the online application page and to all information collected before the date of the change. The new policy will replace any prior policies that are inconsistent. Please check periodically for changes to this Notice, and especially before you provide any personal information to us. If we will materially change how we use, disclose or otherwise process your personal information, we will contact you before doing so and obtain your consent before using, disclosing or otherwise processing your personal information other than as described in this Notice.

Inquiries and Concerns

Please direct any questions or concerns you may have about this Privacy Notice to privacy@chipotle.com.