Chipotle – Recruitment Privacy Notice

US APPLICANT PRIVACY NOTICE, INCLUDING CALIFORNIA JOB APPLICANTS


Last Updated: December 15, 2022

 

 

CMG Strategy Co. LLC. and its subsidiaries and affiliates (collectively, “Chipotle” the “Company” “us” “our” or “we”) provide this US Applicant Privacy Notice, Including California Job Applicants (“Notice”). This Notice describes our privacy practices with respect to our collection of Personal Information in connection with our job applicant and recruiting processes and programs. This Notice also provides our California job applicants with the information required under the California Consumer Privacy Act (“CCPA”). This Notice applies only to job applicants and candidates for employment who are residents of the United States, with certain parts of this Notice specifically referring to residents of the State of California (California applicants are also known as “Consumers” under the CCPA) and from whom we collect Personal Information (“you” or “your”). For purposes of this Notice, when we refer to Consumers, we mean job applicants who reside in California. TO VIEW THIS NOTICE IN SPANISH, CLICK HERE.

“Personal Information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include:

•       Publicly available information from government records.

•       Information that Chipotle has a reasonable basis to believe is lawfully made available to the general public by the you or from widely distributed media (e.g. information you post on social media).

•       Information made available by a person to whom you disclosed the information if you did not restrict the information to a specific audience.

•       De-identified or aggregated information

As a food-focused, people-first company, our mission of Cultivating a Better World means more than just using real ingredients. It means hiring passionate people and investing in their future. It means championing diversity and celebrating inclusion. It means fostering and culture of well-being for our employees and the environment. So whether you are seeking to join our team to grow your career, chase your passion or just pick up a few skills along the way, we want to help you get a real start.

By submitting your Personal Information to us, you acknowledge that:

·       You have read and understood this Notice.

·       You are not required to provide any requested information to us, but failure to do so may result in not being able to continue your candidacy for a job with us.

·       The information you give us is true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related unfavorable information. Providing any inaccurate information may make you ineligible for employment.

·       This Notice does not form part of any contract of employment and does not constitute an offer of employment.

1.     Information We Collect From or About Job Applicants

We may collect Personal Information from you in a variety of different situations and using a variety of different methods, including, but not limited to, on our website, your mobile device, through email, in physical locations, through the mail, and/or over the telephone. Our application process allows you to provide us with your Personal Information that you hold on third-party websites (e.g., TikTok, LinkedIn, Discord, etc.). While your use of those platforms and the handling of your Personal Information is governed by their terms of use and their privacy policies, when we receive your Personal Information as part of your application to Chipotle, our own handling of your Personal Information will follow this Notice.

Generally, we may collect, receive, maintain, and use the following categories of Personal Information, depending on the particular purpose and to the extent permitted under applicable law:

CATEGORY

EXAMPLES

Retention Period

Personal Identifiers and Account Identifiers

Name, alias, postal or mailing address, email address, telephone number, username and password for Chipotle job applicant account, and any required security or access code, password, or credentials allowing access to your Chipotle job applicant account, social security number, driver’s license or state identification card number, date of birth, passport number, immigration status and related documents (e.g. green card, visa, permanent resident card). We may also collect copies of your identification documents.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Contact Information

Home, postal or mailing address, email address, home phone number, cell phone number.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Pre-Hire and Onboarding Information

Information provided in your job application or resume, information gathered as part of background screening (if legally permissible) and reference checks, the results of pre-hire skills testing (if applicable), information related to a request for an accommodation related to a physical or mental disability, information recorded in job interview notes by persons conducting job interviews for the Company, information contained in candidate evaluation records and assessments, information in work product samples you provided, and voluntary disclosures by you, which may include Wage and Opportunity Tax Credit (WOTC) information.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Employment History

Information regarding prior job experience, positions held, work dates and work locations, skills, qualifications, experience, publications, speaking engagements, and preferences (e.g., mobility), absence and leave records, disciplinary and grievance information, employment verification, and termination information, including arrangements to end employment, and when permitted by applicable law your salary history or expectations.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Education Information

Information contained in your resume or provided during the application process regarding educational history and information in transcripts or records of degrees, vocational certifications or other certifications, training courses, or licenses obtained / held, professional memberships.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Inferences

Based on analysis of the Personal Information collected, we may develop inferences regarding job applicants’ predispositions, behavior, abilities, and aptitudes for purposes of recruiting and hiring assessments and decisions.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Medical and Health Information

Medical information related to an infectious disease or pandemic symptoms, exposure, contact tracing, diagnosis, testing, or vaccination.

If hired, this data will be retained for duration of employment plus 6 years. If not hired, it will be retained for 4 years from when position is filled or the date we receive your information, whichever is longer.

Mobile Device Security Information

Data identifying a job applicant’s device accessing Company networks and systems, including cell phone make, model, and cell phone number, and cell phone provider.

6 months

 

Of the above categories of Personal Information, the following are categories of Sensitive Personal Information the Company may collect:

1.     Personal Identifiers and Account Information (social security number, driver’s license or state identification card number, passport number, your Chipotle applicant account log-in, in combination with any required security or access code, password, or credentials allowing access your Chipotle applicant account)

2.     Medical and Health Information

2.     How We Use Personal Information and Sensitive Personal Information

The Personal Information and Sensitive Personal Information we collect, and our use of Personal Information and Sensitive Personal Information, may vary depending on the circumstances. This Notice is intended to provide an overall description of our collection and use of Personal Information and Sensitive Personal Information. Generally, we may use or disclose Personal Information and Sensitive Personal Information we collect from you or about you for one or more of the following purposes:

1.              To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to apply for a job with Chipotle, we will use that Personal Information in connection with your candidacy for employment.

2.              To comply with local, state, and federal law and regulations requiring Chipotle to maintain certain job applicant records as well as local, state, and federal law, regulations, ordinances, guidelines, and orders relating to infectious disease, pandemics, or other public health emergencies.

3.              To evaluate, make, and communicate decisions regarding your job application and candidacy for employment.

4.              To obtain and verify employment, background checks and references.

5.              To communicate with you regarding your candidacy for employment.

6.              To evaluate and improve our recruiting methods and strategies.

7.              To engage in lawful monitoring of job applicant activities and communications when they are on Company premises, or utilizing Company internet and WiFi connections, computers, networks, devices, software applications or systems.

8.              To obtain and verify background checks on job applicants and to verify employment references.

9.              To engage in corporate transactions requiring review or disclosure of job applicant records subject to non-disclosure agreements, such as for evaluating potential mergers and acquisitions of the Company.

10.           To promote and foster diversity, equity, and inclusion in the workplace. As necessary to engage in an audit, exercise its legal rights, including as necessary to defend itself against claims (e.g. pre-litigation and litigation)

11.           With vendors, service providers, and contractors that provide services to Chipotle related to recruiting or processing of data from or about job applicants.

12.           To improve job applicant experience on Company computers, networks, devices, software applications or systems, and to debug, identify, and repair errors that impair existing intended functionality of our systems.

13.           To detect security incidents involving potentially unauthorized access to and/or disclosure of Personal Information or other confidential information, including proprietary or trade secret information and third-party information that Chipotle receives under conditions of confidentiality or subject to privacy rights.

14.           To protect against malicious or illegal activity and prosecute those responsible.

15.           As necessary to engage in an audit, exercise its legal rights, including as necessary to defend itself against claims (e.g. pre-litigation and litigation).

16.           To prevent identity theft.

17.           To verify and respond to consumer requests from job applicants under applicable consumer privacy laws.

18.           Public Health Emergency, including infectious diseases, pandemics, or like for specific purposes.

a.     To reduce the risk of spreading the disease in or through the workplace.

b.     To protect employees, contractors, and customers from exposure to infectious disease or a pandemic related illness.

c.      To comply with local, state, and federal law, regulations, ordinances, guidelines, and orders relating to public health emergency, including an infectious disease or a pandemic, including applicable reporting requirements.

d.     To facilitate and coordinate an infectious disease or pandemic-related initiative and activities (whether Chipotle-sponsored or through the U.S. Center for Disease Control and Prevention, other federal, state and local governmental authorities, and/or public and private entities or establishments, including vaccination initiatives).

e.     To identify potential symptoms linked to an infectious disease or pandemic (including through temperature checks, antibody testing, or questionnaires).

f.      To permit contact tracing relating to any potential exposure.

g.     To communicate with employees, contractors, and customers regarding potential exposure to an infectious disease or pandemic related illness and properly warn others who have had close contact with an infected or symptomatic individual so that they may take precautionary measures, help prevent further spread of the virus, and obtain treatment, if necessary.

3.     Sale/Sharing of Information to Third Parties; Cookies and Other Tracking Technologies Information 

We do not “sell” or “share” the Personal Information or Sensitive Personal Information of our job applicants.

4.     Retention of Personal Information

We will retain each category of personal information in accordance with our established data retention schedule as indicated above. In deciding how long to retain each category of personal information that we collect, we consider many criteria, including, but not limited to: the business purposes for which the Personal Information was collected; relevant federal, state and local recordkeeping laws; applicable statutes of limitations for claims to which the information may be relevant; and legal preservation of evidence obligations.

5.     Changes to this Notice

From time to time, Chipotle may change this Notice. Changes will be indicated by the “Last Updated” date at the top of this page.

6.     Access to Privacy Policy

For more information, please review the Chipotle’s US Privacy Policy at https://www.chipotle.com/about-us/privacy-policy.