Privacy Policy Highlights

Privacy Policy

Restaurant Brands International, Inc. (“RBI”), the proud owner of the BURGER KING®, TIM HORTONS® and POPEYES® restaurant brands, knows that your privacy is important. This Privacy Policy sets out our privacy practices that apply when you visit BURGER KING®, TIM HORTONS®, or POPEYES® restaurants that we own and operate or use any website, mobile or tablet application, digital in-restaurant kiosk, or other online service or platform of BURGER KING®, TIM HORTONS®, POPEYES® or any other RBI company that links or refers to it (collectively, the “Services”), as well as our interactions with you on third party platforms (such as social media).

1. Information We Collect

We collect personal information about our users in various ways. For example, we collect information that you provide to us, information that we collect through your use of the Services, and information that we collect from publicly available sources or third parties.

Information You Provide to Us. We collect information you give us when you use the Services. For example, when you visit one of our restaurants, take advantage of WiFi services provided by a restaurant that we own and operate, visit one of our websites or use one of our Services, create an account with us, buy a stored-value card in-restaurant or online, participate in a survey or promotion, or take advantage of our in-restaurant Wi-Fi service, we may ask for information such as your name, e-mail address, year of birth, gender, street address, or mobile phone number so that we can provide Services to you. We may collect payment information, such as your credit card number, security code and expiration date, to process a financial transaction you have requested. We also may collect information about the products you buy, including where and how frequently you buy them, your use of coupons and stored-value cards, and the rewards you earn through our loyalty programs so that we can learn more about your interests and better serve you.

Information About Your Use of the Services. In addition to the information you provide to us directly, we may collect information about your use of the Services. For example, we may collect:

• Device information – such as your hardware model, IP address, other unique device identifiers, operating system version, and settings of the device you use to access the Services.

• Usage information – such as information about the Services you use, the time and duration of your use of the Services and other information about your interaction with content offered through a Service, and any information stored in cookies and similar technologies that we have set on your device.

• Location information – such as your computer’s IP address, your mobile device’s GPS signal or information about nearby WiFi access points and cell towers that may be transmitted to us when you use the Services.

Information From Third-Party Sources. We may acquire or receive information about you from publicly and commercially available sources, as permitted by law, which we may combine with other information we receive from or about you. For example, we may receive information about you from a social media site if you connect to the Services through that site.

Other Information We Collect. We also may collect other information about you, your device, or your use of the Services in ways that we describe to you at the point of collection or otherwise with your consent.

Personal Information Storage Time. We will keep your personal information for as long as it is needed to fulfil the purposes for which it was collected and in order to comply with legal or regulatory requirements. This may mean that some information is held for longer than other information.

2.How We Use Information

We use the information we collect to, among other things:

• Register and create your account;
• Operate and manage our stored-value card program;
• Provide and manage the products and Services you request;
• Communicate with you about our products, services, and promotions;
• Deliver targeted advertising, promotions, and offers; and
• Understand our customers so that we can develop and improve our customer service, promotions, products, and Services.

We may otherwise use your information with your consent or at your direction.

3. Sharing of Information

The following provides information about entities with which we may share information. Our practices vary depending on the type of information and sharing.

Affiliates. We may share information within our family of affiliated companies so that we may provide offers from those companies that may be relevant to you, better understand your preferences, and improve our Services.

Franchisees. We may share information with local owners of BURGER KING®, TIM HORTONS®, and POPEYES® restaurants, particularly when they will work with us in delivering Services to you. For example, local restaurants will implement delivery and take-away services that you may request through the Services. We also may provide our franchisees with information so that a local restaurant may provide you with offers and promotions that might interest you.

Business Partners. We may also share your information with business partners to provide you with Services that you request. For example, if you sign up for a promotion that runs on our Services but that is sponsored or co-sponsored by another company, your information may be shared with that sponsor. We are not responsible for the privacy practices of these entities and recommend you review their privacy policies carefully.

Service Providers. We may share information with companies providing services on our behalf, such as delivery services, hosting vendors, advertising service providers, data analytics companies, marketing service companies, and list managers. We also may share your information, including your payment information, as appropriate to process your payments for the Services or complete a transaction. Our service providers are given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal information for their own marketing or other unrelated purposes.

Social Media Services. If you connect a social media account with the Services or engage with our services through a social media platform, we may share your information with that social media platform, and it may share information about you with us. We may use this information to personalize your experience on the Services and on the third-party social media platforms, or to provide you with offers or other products or Services you may request. The social media services’ use of the shared information will be governed by the social media services’ privacy policy and your social media account settings. If you do not want your information shared in this way, do not connect your social media service account with the Services.

Companies that Provide Content, Advertising, or Functionality. Some of the content, advertising, and functionality on our Services may be provided by third parties, such as our advertisers. These companies may collect or receive certain information about your use of the Services, including through the use of cookies, beacons, and similar technologies, and this information may be combined with information collected across different websites and online services in order to deliver ads that are more relevant to you, both on and off our Services.

Other Parties When Required or Permitted by Law, or As Necessary to Protect Our Users and Services. We and our service providers (including affiliates) may use and share your personal information as we believe is necessary or appropriate to protect, enforce, or defend the legal rights, privacy, safety, or property of the Services, our employees or agents or users, to detect, suppress or prevent fraud or where otherwise required or permitted by applicable law or legal process, including responding to a search warrant or other legally valid requests from public and government authorities (which may include lawful access by U.S., Canadian, or other governmental authorities, courts or law enforcement agencies).

Other Parties in Connection With a Corporate Transaction. We reserve the right to transfer any information we have about you in the event that we sell or transfer all or a portion of our business or assets to a third party, such as in the event of a merger, acquisition, or in connection with a bankruptcy reorganization.

Otherwise With Your Consent or at Your Direction. In addition to the sharing described in this Privacy Policy, we may share information about you with third parties whenever you consent to or direct such sharing.

Aggregated Data. We also may provide aggregated information, and data with personal identifiers removed, to third parties to describe how our customers are using the Services.

Sale of Personal Data. We do not “sell”, as defined in applicable state laws/regulations (e.g. the California Consumer Privacy Act or the Nevada Privacy Act), personal information to any third parties for monetary or other financial considerations and have not done so within the previous 12 month period from the date listed on this policy.

4. Online Advertising and Cookies

We and other companies that provide advertising and other services on our Services may use cookies, web beacons, and similar technologies to facilitate administration and navigation, to better understand and improve our Services, to determine and improve the advertising shown to you here or elsewhere, and to provide you with a customized online experience.

Interest – Based Advertisements. We may use third parties to serve advertisements on our Services and on other websites and digital platforms. These companies may use cookies, web beacons or other technologies to report certain information about your visits to our Services and other websites (such as web pages you visit and your response to ads) in order to measure the effectiveness of our marketing campaigns and to deliver ads that are more relevant to you, both on and off our Services. To learn more and to opt-out of having your information used by these companies for online behavioral advertising purposes, please see “Choices with Respect to Interest-Based Advertisements” below. We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms. We may do this by providing a hashed version of your email address or other information to the platform provider.

Cookies. “Cookies” are small files that are placed on your computer when you visit a website. Cookies may be used to store a unique identification number tied to your computer or device so that you can be recognized as the same user across one or more browsing sessions, and across one or more sites. Cookies serve many useful purposes. For example:

• Cookies can remember your sign-in credentials, so you do not have to enter those credentials each time you visit a Service

• Cookies can help us and third parties understand which parts of our Services are the most popular because they help us see which pages and features visitors access and how much time they spend on the pages. By studying this kind of information, we are better able to adapt our Services and provide you with a better experience.

• Cookies help us and third parties understand which ads you have seen so that you don’t receive the same ad each time you access a Service.

Most browsers accept cookies automatically but can be configured not to do so. If you wish to disable cookies, refer to your browser help menu to learn how to disable cookies. If you disable cookies, it may interfere with the functioning of the Services.

Beacons. We, along with third parties, also may use technologies called beacons (or “pixels”) that communicate information from your device to a server. Beacons can be embedded in online content, videos, and emails, and can allow a server to read certain types of information from your device, know when you have viewed particular content or a particular email message, determine the time and date on which you viewed the beacon, and the IP address of your device. We and third parties use beacons for a variety of purposes, including to analyze the use of our Services and (in conjunction with cookies) to provide content and ads that are more relevant to you both on and off the Service.

Do-Not-Track Signals and Similar Mechanisms. Some web browsers may transmit “do-not-track” signals to the websites with which the user communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. Because there currently is no industry standard concerning what, if anything, websites should do when they receive such signals, the Services currently do not take action in response to these signals. If and when a final standard is established and accepted, we will reassess how to respond to these signals.

5. Privacy and Access Choices Available To You

Choices With Respect To Cookies and Similar Technologies. You may block cookies and similar technologies in your browser or device settings, as and if permitted by such device.

Choices With Respect To Interest – Based Advertising. You may opt out of receiving targeted advertising from participating ad networks, audience segment providers, ad serving vendors, and other service providers by visiting websites operated by the Network Advertising Initiative, Digital Advertising Alliance and Digital Advertising Alliance of Canada.

Manage Your Account. You may access, modify or delete your account on the settings or profile page, or by contacting the Privacy Officer at privacy@rbi.com with such written request. In addition, you may contact us at 1 (888) 601-1616 (United States and Canada) or by clicking on this link. Whichever way you elect to contact us, we may ask that you confirm and verify your identity.

Data Access. Subject to applicable law, you may also have a right to access, update, and correct inaccuracies in other personal information in our custody and control, subject to certain exceptions prescribed by law. You may request access, updating and corrections of inaccuracies in the personal information we have in our custody or control by emailing or writing to us at the contact information set out below. We may request certain personal information for the purposes of verifying the identity of the individual seeking access to their personal information records.

Email Promotions. You may opt out of receiving commercial email, text message, and other electronic messages from us (excluding transactional messages) by following the instructions contained in those messages.

6. Data Security

We have in place physical, electronic and managerial procedures to protect personal information in our custody and control against loss, theft and unauthorized access, use, modification and disclosure. However, as effective as these measures are, no security system is impenetrable. We cannot guarantee the security of our Services, nor can we guarantee that the information you provide will not be intercepted while being transmitted to us over the Internet.

Local Storage & Other Tracking Technologies. We, along with third parties, may use other kinds of technologies, such as Local Shared Objects (also referred to as “Flash cookies”) and HTML5 local storage, in connection with our Services. These technologies are similar to the cookies discussed above in that they are stored on your device and can be used to store certain information about your activities and preferences. However, these technologies may make use of different parts of your device from standard cookies, and so you might not be able to control them using standard browser tools and settings. For HTML5 local storage, the method for disabling HTML5 will vary depending on your browser. For Flash cookies, information about disabling or deleting information contained in Flash cookies can be found here.

7. Other Important Information

Children’s Privacy. We do not knowingly collect any personal information from children under the age of 13 without parental consent, unless permitted by law. If we learn that a child under the age of 13 has provided us with personal information, we will delete it in accordance with applicable law.

Links to Third-Party Sites. Our Services may link to third-party websites and services that we do not operate and are outside of our control. We are not responsible for the security or privacy of any information collected by other websites or other services. Please exercise caution and review the privacy statements applicable to the third-party websites and services you use.

Your California Privacy Rights. As a California resident, you have certain rights over your Personal Information held by RBI and its affiliates under the California Consumer Privacy Act (the “CCPA”). California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their direct marketing purposes in the preceding calendar year.

The rights afforded to you as a California resident are as follows:

– The right to request the deletion of any Personal Information about you that has been collected from the you;

– The right to request disclosures regarding the collection of your Personal Information;

– The right to request disclosures regarding the sale of your Personal Information or disclosures made for a business purpose;

– The right not to be discriminated against for exercising your rights under the CCPA;

– The right to opt-out of the sale of your Personal Information.

Requests to exercise the above-described rights should be directed to privacy@RBI.com.In addition, you may contact us at 1 (888) 601-1616 (United States and Canada) or by clicking on this link. Whichever way you elect to contact us, we may ask that you confirm and verify your identity.

Your Nevada Privacy Rights. As a Nevada resident, you have the right to opt-out of the sale of your Personal Information collected by us through the RBI corporate website, applications (e.g. mobile applications) or the website/applications of any RBI®. brands (BURGER KING®, TIM HORTONS®, and POPEYES® restaurants).

Requests to exercise the above-described rights should be directed to privacy@RBI.com.In addition, you may contact us at 1 (888) 601-1616 (United States and Canada) or by clicking on this link. Whichever way you elect to contact us, we may ask that you confirm and verify your identity.

International Transfers. The Services are headquartered in the United States. Please be aware that information you provide to us or that we obtain as a result of your use of the Services may be collected in your country and subsequently transferred to, maintained and processed in the United States or another country by us or our service providers for the purposes mentioned above in accordance with applicable law. The privacy laws of these countries may not always offer the same level of protection as in your country. By using the Services, you consent to the collection, international transfer, storage, and processing of your information.

Changes to Our Privacy Policy. We may modify this Privacy Policy from time to time. We will notify you of changes by posting changes here, or by other appropriate means. Any changes to the Privacy Policy will become effective when the updated policy is posted on the Services. Your use of the Services or your provision of personal information to use the Services following such changes indicates your acceptance of the revised Privacy Policy.

Questions. Please contact our Privacy Officer at privacy@rbi.com with any questions or concerns about this Privacy Policy or the manner in which we or our service providers treat your personal information.In addition, you may contact us at 1 (888) 601-1616 (United States and Canada) or by clicking on this link. Whichever way you elect to contact us, we may ask that you confirm and verify your identity.