Last updated: June 29, 2026
This Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your information when you use our website and online ordering services, and tells you about your privacy rights and how the law protects you.
We use your personal data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.
Interpretation and Definitions
Interpretation
The words whose initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or plural.
Definitions
- Company (referred to as “the Company,” “We,” “Us,” or “Our”) refers to Shawarma House SD, 4884 Newport Ave, San Diego, CA 92107.
- Service refers to the Company’s website at shawarmahousesd.com and our online ordering, gift-card, and catering pages (including those hosted by our ordering provider).
- Personal Data is any information that relates to an identified or identifiable individual. For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with you.
- Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
- Service Provider means any natural or legal person who processes the data on behalf of the Company.
- You means the individual accessing or using the Service.
- CCPA/CPRA refers to the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020.
- GPC (Global Privacy Control) is a browser-level signal that communicates a consumer’s choice to opt out of the sale or sharing of personal information.
Notice at Collection
At or before the point we collect personal information, we want you to know the following:
| What we collect | Why | Sold? | Shared for ads? | Retention |
|---|---|---|---|---|
| Identifiers & contact data — name, email, phone, delivery/billing address | Process and deliver your order; respond to inquiries; send updates | No | No | Up to 7 years |
| Order & transaction data — items ordered, history, amounts | Fulfill orders; accounting; improve our menu | No | No | Up to 7 years |
| Payment information — card data | Process payment (handled by our processors; we don’t store full card numbers) | No | No | Not retained by us |
| Internet/device & usage data — IP address, browser, pages visited | Site security, analytics, performance | No | Yes (see below) | Up to 14 months |
| Approximate geolocation — from IP/device, with permission | Show the right location/menu; analytics | No | Yes (see below) | Up to 14 months |
| Marketing preferences — email/SMS opt-in status | Send promotions you asked for | No | No | Until you unsubscribe |
We do not sell your personal information for money. We do use Google advertising and analytics tools that, under California law, may be considered “sharing” of online identifiers and activity for cross-context behavioral advertising. You can opt out at any time — see “Your Privacy Choices” below — and we honor Global Privacy Control signals.
Collecting and Using Your Personal Data
Personal Data
While using our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you, including: email address; first and last name; phone number; delivery or billing address; and Usage Data. We do not collect government identifiers (such as Social Security, driver’s license, or passport numbers), health information, or biometric data through the Service.
Usage Data
Usage Data is collected automatically when using the Service. It may include your device’s IP address, browser type and version, the pages you visit, the time and date of your visit, time spent on those pages, unique device identifiers, and other diagnostic data.
Information from Your Location
With your permission, we may collect approximate location information to provide and customize features of the Service. You can enable or disable location access at any time through your device settings.
Payment Processing
We provide online ordering and gift-card purchases. We do not store or collect your full payment-card details; that information is provided directly to our third-party payment processors, whose use of your information is governed by their privacy policies. Our processors adhere to PCI-DSS standards.
- Toast — online ordering, gift cards, and point-of-sale. Privacy Policy: https://pos.toasttab.com/privacy
- WorldPay — payment processing. Privacy Policy: https://www.worldpay.com/en-gb/privacy-policy
Third-party delivery platforms (e.g., DoorDash, Grubhub) that you may use to order from us operate under their own privacy policies; we encourage you to review them.
Cookies and Tracking Technologies
We and our Service Providers use cookies and similar technologies to operate the Service, remember your preferences, analyze traffic, and measure advertising. The categories we use are:
- Strictly necessary — required for the site, cart, and checkout to function.
- Analytics — Google Analytics (GA4), deployed via Google Tag Manager.
- Advertising / conversion measurement — Google Ads tags. Under California law these may be considered “sharing” of personal information for cross-context behavioral advertising.
We do not use Meta (Facebook) Pixel, TikTok, or similar social-media advertising pixels on the Service. You can control cookies through your browser settings and opt out as described in “Your Privacy Choices.” We honor Global Privacy Control (GPC) signals as a valid opt-out of sharing.
Use of Your Personal Data
The Company may use Personal Data to: provide and maintain the Service; manage your orders and requests; perform a contract; contact you by email, phone, SMS, or push notification about your order or — where you have opted in — promotions; for business transfers; and for analytics and improving the Service. We may share your personal information with Service Providers (ordering, payment, hosting, analytics, advertising measurement, email/SMS delivery), in a business transfer, with affiliates bound by this Policy, and with your consent. We do not share your information with third parties for their own independent marketing.
Your Privacy Choices (Do Not Sell or Share / Opt-Out)
Although we do not sell your personal information for money, our use of Google advertising and analytics may qualify as “sharing” under the CCPA/CPRA. You have the right to opt out. You can:
- Send a Global Privacy Control (GPC) signal — we treat an enabled GPC signal as a valid request to opt out of sharing for that browser or device.
- Use the “Opt-out preferences” link in our cookie banner.
- Contact us at info@shawarmahousesd.com or (619) 642-0298 and ask us to opt you out.
We will not discriminate against you for exercising any privacy right.
Retention of Your Personal Data
- Order and transaction records — up to 7 years (tax and accounting).
- Email and SMS marketing contacts — until you unsubscribe.
- Website analytics data — up to 14 months.
- Customer-service correspondence — up to 2 years.
We may retain information longer where required by law, to resolve disputes, or to enforce our agreements.
Email Marketing
We may use your personal data to contact you with newsletters and promotions. Every commercial email we send identifies itself as an advertisement where required, includes our valid physical postal address, and contains a clear unsubscribe link. You may opt out at any time by clicking unsubscribe or contacting us; we honor opt-out requests within 10 business days.
SMS / Text Messaging
If you opt in to marketing text messages — for example, by approving the SMS marketing consent disclosure during sign-up or checkout through our ordering provider (Toast) — you consent to receive transactional and/or promotional text messages from us. Message and data rates may apply. You can opt out at any time by replying STOP, and we will honor opt-out requests within 10 business days; reply HELP for help. Consent to receive marketing texts is not a condition of any purchase. Your mobile information is not sold or shared with third parties for their marketing.
Notice of Financial Incentive (Rewards Program)
We offer a rewards/loyalty program that provides a financial incentive in exchange for collecting and using certain personal information. Under the CCPA/CPRA, we are providing this notice of the program’s material terms:
- The incentive: When you sign up, you receive 25 bonus points. You then earn 1 point for every $1 you spend, and you can redeem 100 points for $10 off a future order.
- How to enroll: Provide your name and phone number and/or email at checkout or online.
- Personal information collected through the program: identifiers (name, phone number, email) and purchase history.
- How to withdraw: You may unenroll at any time by contacting us at info@shawarmahousesd.com or (619) 642-0298. Withdrawal stops future point accrual.
- Value of your data and how we calculate it: The value of the personal information collected through the program is reasonably related to the value of the rewards and discounts you receive. We do not place a monetary value on your personal information beyond the cost of the incentives we provide, which we estimate based on the expense of the points, discounts, and rewards redeemed by participants.
Participation is entirely voluntary, and we will not deny you goods or services, charge a different price, or provide a different level of quality because you choose not to participate.
Disclosure of Your Personal Data
Business Transactions. If the Company is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.
Law Enforcement. Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities.
Other Legal Requirements. We may disclose your Personal Data in the good-faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, prevent or investigate wrongdoing, protect the personal safety of users or the public, or protect against legal liability.
Security of Your Personal Data
The security of your Personal Data is important to us. We use commercially reasonable means to protect it, but no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your unencrypted personal information, we will notify affected individuals and applicable authorities as required by law (including California Civil Code § 1798.82).
Automated Decision-Making
We do not use automated decision-making technology (ADMT) or profiling to make decisions that produce legal or similarly significant effects about you.
Children’s Privacy
Our Service does not address anyone under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us, and we will take steps to remove that information. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to: know/access the categories and specific pieces of personal information we collect; delete your personal information (subject to exceptions); correct inaccurate personal information; opt out of the sale or sharing of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising these rights. We do not sell personal information for monetary value. We may “share” identifiers and internet-activity data for cross-context behavioral advertising via Google tools; you may opt out as described in “Your Privacy Choices.” To exercise your rights, contact us using the details below. We will verify your identity before responding and will respond within 45 days (extendable once by 45 days with notice).
“Do Not Track” and Opt-Out Preference Signals
Most browsers do not transmit a uniform “Do Not Track” signal, so we are not able to respond to legacy DNT signals. However, we do honor recognized opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of the sharing of personal information for the browser or device that sends the signal.
Links to Other Websites
Our Service may contain links to other websites that we do not operate (including our ordering and delivery partners). We strongly advise you to review the Privacy Policy of every site you visit. We have no control over, and assume no responsibility for, the content or privacy practices of any third-party sites.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date at the top. Changes are effective when posted on this page.
Contact Us
If you have any questions about this Privacy Policy, or to exercise any of your privacy rights, you can contact us:
- By email: info@shawarmahousesd.com
- By phone: (619) 642-0298
- By mail: Shawarma House SD, 4884 Newport Ave, San Diego, CA 92107
