Privacy Policy

Last Updated: [10/28/2026]

Introduction

HOCCO Foods USA LLC, a Georgia limited liability company, doing business as Hocco – The Indian Kitchen (“Hocco,” the “Company,” “we,” “us” or “our”), respects the privacy of individuals who visit the Company’s websites, use its online ordering, catering or rewards services, place orders, submit franchise or business enquiries or otherwise communicate with the Company, and is committed to handling personal information responsibly, transparently and securely.

This Privacy Policy (“Policy”) describes how the Company collects, uses, discloses, retains and protects personal information in connection with its websites, including https://hocco.us and https://order.hocco.us (each, a “Website”), its online ordering and catering services, its rewards and loyalty programme, its email and text-message programmes, and any other online or customer-facing service that links to or posts this Policy (collectively, the “Services”). This Policy also serves as the Company’s notice at collection under applicable U.S. state privacy laws.

Hocco restaurants in the United States are owned and operated by the Company’s master franchisee for the United States, Ingenious Foods Franchising LLC (the “Master Franchisee”), or by independently owned and operated franchisees of the Master Franchisee (each, together with any restaurant operated by the Master Franchisee, a “Franchised Restaurant”). As at the “Last Updated” date, Hocco restaurants are located in Chesapeake, Virginia; Greenville, South Carolina; Hoffman Estates, Illinois; Mason, Ohio; Frisco, Texas; and Cumming, Georgia. This Policy applies to personal information collected through the Services regardless of the state from which you access them, and shall apply equally to any other states, cities or regions in which Hocco restaurants may operate in the future.

Each Franchised Restaurant, and the Master Franchisee, is an independent business. Each of them is solely responsible for personal information it collects or processes on its own behalf, including information collected in its restaurant, through its own point-of-sale, Wi-Fi, CCTV or reservation systems, in connection with employment, and through any mobile application, website, social-media page or programme that it operates. Where the Master Franchisee or a Franchised Restaurant operates an application or service that posts its own privacy notice (including any Hocco-branded mobile application operated by the Master Franchisee), that notice governs that application or service, and, to the fullest extent permitted by applicable law, the Company is not responsible for the privacy practices of the Master Franchisee or any Franchised Restaurant.

The Company handles personal information in accordance with applicable federal and state privacy, data protection and information security laws, including, where applicable, the Federal Trade Commission Act, the Children’s Online Privacy Protection Act, the CAN-SPAM Act, the Telephone Consumer Protection Act, the California Online Privacy Protection Act, state comprehensive consumer privacy laws (such as the Virginia Consumer Data Protection Act and the Texas Data Privacy and Security Act), and state data security and breach-notification laws. This Policy describes the Company’s general practices and principles governing the collection, use, processing, disclosure, retention and protection of personal information in connection with its Services.

This Policy shall be read in conjunction with any specific privacy notice, consent form, disclosure, campaign-specific terms or other applicable communication issued by the Company in relation to a particular activity, service or purpose. Where such a notice or communication supplements or specifies the Company’s practices for a particular activity or purpose, it shall be read together with this Policy. In the event of any inconsistency, the specific notice or communication shall prevail to the extent it lawfully applies to that activity or purpose, provided, that nothing in such notice or communication shall limit or override any mandatory requirement or right under applicable law.

By accessing or using the Services, you acknowledge that you have read and understood this Policy. Your use of the Services is also governed by the Company’s Terms of Use, available at https://hocco.us/terms-of-use. If you do not agree with this Policy, please do not use the Services.

Scope

This Policy applies to personal information processed by the Company through the Services. It does not apply to: (a) personal information collected or processed by the Master Franchisee or any Franchised Restaurant on its own behalf; (b) personal information of the Company’s employees, contractors and job applicants, which is addressed in separate notices; or (c) the privacy practices of independent third parties, including third-party websites, applications, payment providers, third-party delivery platforms (such as Uber Eats, DoorDash and Grubhub) and social-media services that may be linked to or accessible from the Services. Such third parties process personal information in accordance with their own privacy practices.

The Services are intended for individuals located in the United States. If you access the Services from outside the United States, you understand that your personal information will be processed in the United States and in the other countries described under “International Data Transfers” below.

Personal Information We Collect

The categories of personal information the Company collects depend on how you interact with our Services and which features you use.

Information You Provide

The Company may collect the following information when you place an order, contact us, submit a request or otherwise interact with us:

Contact information: name, telephone number, email address, postal or delivery address, city, state and ZIP code.
Rewards and account information: information you provide to create an online ordering account or to enrol in our rewards or loyalty programme, including your first and last name, telephone number (which is required for enrolment), email address, postal address, city, state and ZIP code, date of birth (where requested, for birthday offers), points and rewards earned and redeemed, offers received and redeemed, and programme preferences.
Order information: items ordered, order preferences, dietary preferences and any allergy or special-handling instructions you choose to provide, the restaurant selected, pickup or delivery details, order history, order status, promotional codes used and related customer-service communications.
Location information: the restaurant you select, your delivery address and, where you choose to enable location services on your browser or device, your device’s location, which we use to identify the nearest Hocco restaurant and to facilitate restaurant selection for dine-in, pickup or delivery.
Catering information: your name, email address, telephone number, event type, event date, estimated number of guests, event location and ZIP code, how you heard about us and any additional details you provide.
Enquiry, feedback and customer-service information: information you submit through our “Contact Us” form (name, email address, telephone number, subject and message) and the contents of other messages, complaints, requests, reviews and store details, and any other information you voluntarily provide to the Company.
Promotions and survey information: information you provide when you participate in promotions, contests, sweepstakes, surveys or events, or when you subscribe to our email or text-message communications, including your communication preferences and consent records.
Franchise or business enquiry information: your name, email address, telephone number, location of interest, message and any other information you submit through a franchise enquiry form or business proposal, including information about your business experience, financial qualifications or proposed development area if you choose to provide it.
Communications and content: records of your communications with us (including customer-service calls, where permitted by law and subject to any required notice), and reviews, photographs, testimonials and other content you submit to us or post on our social-media pages.

Please do not submit sensitive personal information (such as Social Security numbers, financial-account details or health information) unless it is specifically requested and necessary for a disclosed purpose.

Photographs and Video Recordings for Promotional and Advertising Purposes

Ingenious or its franchisees, through event organisers, marketing agencies or other persons acting on their behalf may capture, photograph, film, record or otherwise create photographs, videos, audio-visual recordings and related content featuring customers, visitors, guests, participants and other individuals present at or attending any event, gig, contest, competition, campaign, promotional activity, celebration, launch, special occasion or other activity organized, sponsored, hosted, supported or conducted at the restaurant or other premises operated by Ingenious or its franchisees.
Such photographs, videos and recordings shall be captured only after obtaining the prior consent of the individuals concerned, in accordance with applicable laws. The individuals shall be informed of the intended capture and use of such content through appropriate consent forms, written or electronic acknowledgements, event registrations or other suitable means.
Subject to the consent obtained and applicable law, the Company, Ingenious or its franchisees shall be entitled to access, collect, and use such photographs, videos and recordings for legitimate business purposes, including its website, advertising, marketing, promotional campaigns, documentation of events, social media engagement and the promotion of the Company’s products, services, restaurants, franchise network and related activities.
For the foregoing purposes, such content may be accessed by the Company from its headquarters, registered office, corporate office, other offices, establishments or any other location from which the Company carries on its business or manages its operations.
Once the requisite consent has been obtained for the purposes described above, separate or repeated permission shall not be required for each subsequent use, publication, reproduction or dissemination of the relevant photographs, videos or recordings, to the extent such use remains within the scope of the consent obtained and is otherwise permitted by applicable law. Ingenious or its Franchisees or Company may retain and use such content for the period reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal requirements and any valid request for withdrawal of consent or other rights available to the individual concerned under applicable law.
The Company shall take reasonable measures to ensure that photographs, videos and recordings are used for the stated purposes and handled in accordance with its applicable privacy practices. Individuals may contact the Company through the contact details provided in this Privacy Policy for queries or requests relating to such content, including requests concerning the withdrawal of consent.
Any individual who has previously provided consent for the capture or use of their photographs, videos or recordings may withdraw such consent at any time by contacting the Company through the contact details provided in this Privacy Policy. Upon receiving such a request, further use of the relevant content for promotional or advertising purposes shall be ceased and take reasonable steps to remove or take down such content from its websites, social media platforms and other digital channels under its control, within a reasonable period.

Payment Information

Payments for online orders are processed by third-party payment processors engaged by the Company, by the operator of the relevant restaurant or by the online ordering platform.

The Company does not collect or store full payment card numbers on its own systems. Payment processors collect and process payment card details and other information necessary to authorise and complete transactions.

We may receive transaction confirmations, payment status, transaction identifiers, limited payment details and refund information necessary to administer orders and resolve payment-related issues.

The payment processor’s own privacy notice and terms may apply to information collected directly by that provider.

Information Collected Automatically

When you access or use our Services, we, our service providers and our analytics and advertising partners automatically collect certain information about your device and your use of the Services, including:

Internet Protocol (IP) address;
browser type, device type and operating system;
website pages, screens or features accessed, and links and buttons clicked;
date, time and duration of visits;
referring and exit webpages, search terms and interaction logs;
mouse movements, clicks, scrolling, taps and other interactions with the Services, which may be recorded through session-replay and heat-mapping tools;
advertising identifiers, pixel and tag data, and information about whether you have viewed or interacted with our advertisements;
approximate location inferred from an IP address; and
cookie identifiers and similar technical identifiers.

For more information about these technologies and your choices, see “Cookies and Similar Technologies” and “Sale, Sharing, Targeted Advertising and Profiling” below.

Information from Third Parties

We may receive information about you from the Master Franchisee and Franchised Restaurants, online ordering platforms, payment processors, third-party delivery platforms, customer-support providers, social-media platforms (for example, when you interact with our pages or advertisements), advertising and analytics partners, publicly available sources and other service providers, where necessary to operate the Services, complete orders, administer the rewards programme and refunds, address customer enquiries, market our products or prevent fraud. We may also receive information from other sources where you have authorised the disclosure or where collection is otherwise permitted by law.

Sensitive Personal Information

We do not intend to collect sensitive personal information through ordinary food-ordering activities. However, certain information may be treated as sensitive under applicable law, including: (a) precise geolocation, which we collect only if you enable location services on your browser or device and grant permission; and (b) dietary, allergy or similar information you choose to include with an order or catering enquiry, which we use solely to prepare and fulfil your order and not for marketing, profiling or advertising. Where applicable law requires consent to process sensitive personal information, we will obtain that consent before processing it, and you may withdraw it at any time. We do not sell sensitive personal information, use it for targeted advertising or use it to infer characteristics about you. We do not collect biometric identifiers or biometric information.

How We Use Personal Information

Subject to applicable law, the Company may use personal information for the following purposes:

To receive, process, confirm and fulfil food orders and catering requests, and to route orders to the relevant Hocco restaurant.
To arrange pickup or delivery and communicate order updates.
To process payments, refunds, cancellations and transaction-related enquiries.
To respond to questions, complaints, feedback and customer-support requests.
To provide, administer, operate, maintain, troubleshoot and improve our Services.
To receive, evaluate and respond to franchise enquiries, applications and business proposals, including by referring them to the Master Franchisee where appropriate.
To communicate with you in relation to any interaction, request, transaction, campaign or service.
To maintain records of transactions and administer our business operations.
To detect, investigate and prevent suspected fraud, unauthorised activity, security incidents and misuse of the Services.
To personalise your experience, such as by remembering your preferred restaurant and order history and recommending menu items.
To comply with applicable legal obligations and respond to lawful requests from competent authorities.
To administer our rewards and loyalty programme, including tracking points and rewards, verifying eligibility and sending birthday and other programme offers.
To conduct analytics, measure the performance of the Services and our advertising, and understand how users interact with the Services.
To maintain business, security, audit and compliance records.
To establish, exercise or defend legal rights and claims.
To send you promotional communications by email, text message, push notification or other channels, to run promotions and campaigns, and to serve and measure advertising, including targeted advertising, in each case in accordance with applicable law and your choices and consent where required.
To carry out any other purpose of which you have been informed at the time of collection and, where required, to which you have provided valid consent.
To operate, manage, protect and improve the Hocco franchise system, including monitoring brand standards, product quality and customer satisfaction at Hocco restaurants.
To create aggregated, de-identified or anonymised information, which we may use for any lawful purpose. We will maintain and use de-identified information in de-identified form and will not attempt to re-identify it, except as permitted by law.

We will not use personal information for a materially different purpose where applicable law requires additional notice or consent and that requirement has not been satisfied.

General Principles of Processing

The Company collects, uses, processes and discloses personal information for lawful, specified and legitimate business purposes, in accordance with this Policy and applicable federal and state laws. The Company seeks to limit the collection and processing of personal information to what is reasonably necessary and relevant for the purposes disclosed at the time of collection or otherwise permitted by applicable law.

Where consent is required under applicable law, the Company shall obtain the individual’s consent before collecting, processing or disclosing personal information for the relevant purpose. Such consent shall be obtained through an appropriate affirmative action or other legally recognised method and shall be specific, informed and freely given, as required by applicable law.

Where applicable, individuals may withdraw their consent, subject to legal limitations and the consequences of withdrawal for the relevant service or processing activity. Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.

Processing Necessary for Orders and Services

The Company may process personal information, to the extent reasonably necessary and permitted by applicable law, to receive and fulfil orders, process payments and refunds, coordinate pickup or delivery, communicate order updates, provide customer support, administer customer accounts or programmes, and perform other activities directly related to the Services requested by the individual.

Other Permitted Business and Operational Purposes

Subject to applicable law, the Company may process personal information for purposes including maintaining and improving the Services, managing business operations, processing and evaluating franchise applications and business proposals, communicating with prospective franchisees and business partners, assessing business opportunities, maintaining transaction and business records, resolving disputes, preventing fraud, detecting unauthorised activity, protecting the security and integrity of its systems, and complying with applicable legal and regulatory obligations.

Processing by Service Providers

The Company may engage third-party service providers, including online ordering and rewards platforms, payment processors, technology and hosting providers, analytics and session-replay providers, marketing and communications providers, customer-support providers and delivery or fulfilment providers, to perform services on its behalf. Such providers may process personal information only to the extent necessary to perform their contracted services and in accordance with applicable contractual and legal requirements.

Where required by applicable law, the Company shall implement appropriate contractual safeguards governing such processing, including provisions concerning the permitted purposes of processing, confidentiality, security, retention, deletion or return of personal information, and assistance with applicable compliance obligations.

Disclosure Required or Permitted by Law

The Company may disclose personal information where reasonably necessary and legally permitted or required, including to comply with applicable laws, regulations, court orders or lawful governmental requests; establish, exercise or defend legal claims; investigate suspected fraud or unlawful activity; protect the rights, safety or security of the Company, individuals or other persons; or support an actual or proposed merger, acquisition, restructuring or transfer of business assets, subject to applicable law.

Changes in Processing Purposes

If the Company intends to process personal information for a new or materially different purpose, it shall provide any additional notice and obtain any consent required by applicable law before commencing such processing. Any specific privacy notice, consent form, campaign-specific disclosure or other communication issued by the Company for a particular activity shall be read together with this Policy and shall govern that activity to the extent of any inconsistency, provided that it does not override any mandatory requirement of applicable law.

How We Disclose Personal Information

The Company may disclose personal information for the purposes described in this Policy to the following categories of recipients:

Hocco Franchise System: The Master Franchisee and Franchised Restaurants, for example to fulfil an order you place with a Franchised Restaurant, to administer the rewards programme across participating restaurants, to respond to feedback about a particular restaurant or to refer franchise enquiries.
Affiliates and Group Entities: The Company’s affiliates and group entities, including HOCCO group entities in India, where such sharing is permitted by applicable law and necessary for the relevant business purpose.
Service Providers and Business Partners: Data processors, vendors, professional advisers, technology and hosting providers, analytics providers, customer-support providers and other service providers engaged to perform services for or on behalf of the Company, subject to applicable legal and contractual safeguards.
Advertising and Analytics Partners: third parties such as Meta Platforms, Inc. (Facebook and Instagram), Google LLC (including Google Analytics and Google Ads) and Microsoft Corporation (Microsoft Clarity), which collect information through cookies, pixels and similar technologies on the Services. See “Sale, Sharing, Targeted Advertising and Profiling” below.
Delivery and Ordering Platforms: third-party delivery and ordering platforms, where you choose to order through or have your order fulfilled by them.
Franchise and Business Proposal Evaluators: Persons involved in receiving, reviewing, evaluating, processing or administering franchise applications, business proposals or prospective business arrangements submitted to the Company.
Governmental and Legal Authorities: Governmental, regulatory, judicial, law-enforcement and other competent authorities where disclosure is required or permitted by applicable law.
Corporate and Financial Transactions: Prospective or actual purchasers, investors, lenders, professional advisers and other relevant parties in connection with an actual or proposed merger, restructuring, financing, acquisition, sale or transfer of all or part of the Company’s business or assets, subject to applicable confidentiality obligations and legal safeguards.
Others with Your Consent: other third parties where you have directed us to disclose your personal information or have otherwise consented.

Certain U.S. state privacy laws define “sale,” “sharing,” “targeted advertising” and “profiling” broadly. Under some of those laws, disclosing information such as cookie identifiers and browsing activity to advertising partners can be a “sale” or “sharing” even where no money is exchanged.

Sale of Personal Information

The Company does not sell personal information for monetary consideration. However, our use of third-party advertising cookies, pixels and similar technologies (including the Meta Pixel and Google Ads tags) may constitute a “sale” of personal information, “sharing” for cross-context behavioural advertising, or processing for “targeted advertising” under certain state laws. In the preceding twelve (12) months, the categories of personal information disclosed in this manner were identifiers (such as IP address and cookie and device identifiers) and internet or other electronic network activity information (such as pages viewed and interactions with the Services), and the recipients were advertising and analytics partners. We do not knowingly sell or share the personal information of, or process for targeted advertising the personal information of, consumers under the age of eighteen (18).

Targeted Advertising and Profiling

The Company engages in targeted advertising, including by using information collected through cookies and pixels to show you Hocco advertisements on other websites and social-media platforms and to measure their effectiveness. The Company does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.

Consumer Privacy Choices

You may opt out of the sale of your personal information, sharing for cross-context behavioural advertising and targeted advertising by: (a) clicking “Your Privacy Choices” link in the footer of our Website and adjusting your cookie preferences; (b) enabling a recognised universal opt-out preference signal, such as Global Privacy Control (GPC), in your browser, which we will treat as a valid opt-out request for that browser or device and, where you are signed in, for your account; or (c) contacting us as described under “Contact Us”. Because cookie-based opt-outs are specific to the browser and device you use, you must opt out on each browser and device. Nothing in this Section limits any rights afforded to individuals under applicable federal or state privacy laws.

Cookies and Similar Technologies

The Company and its third-party service providers and partners use cookies, pixels, tags, software development kits, session-replay scripts, server logs and similar technologies on the Services. We use them to support essential functionality, maintain sessions, remember preferences, understand usage patterns, analyse performance, enhance user experience and facilitate advertising and marketing activities. These technologies currently fall into the following categories:

Categories of Technologies

Strictly necessary and security

Technologies required for the Services to function, such as session and shopping-cart cookies, and Google reCAPTCHA. reCAPTCHA protects our forms against spam and abuse by collecting hardware and software information (such as device and application data) and sending it to Google for analysis. Its use is subject to Google’s Privacy Policy and Terms of Service.

Advertising and marketing

The Meta Pixel and Google Ads conversion and remarketing tags. These allow us and our partners to measure the effectiveness of our advertising and to show you Hocco advertisements on other websites and platforms. You can also manage interest-based advertising through your Meta and Google account settings and at https://optout.aboutads.info.

Consent and Privacy Choices

Where required by applicable law, the Company shall obtain consent before using cookies or similar technologies for which consent is legally required. You may manage your preferences at any time through the “Your Privacy Choices” link and cookie settings made available on the Website and online ordering platform. The Company shall honour applicable opt-out rights, including through Global Privacy Control signals, relating to targeted advertising, sales, sharing or other covered data processing activities in accordance with applicable law.

Browser Settings

You may be able to block or delete certain cookies through your browser settings. However, disabling essential cookies or similar technologies may affect the functionality, availability or performance of certain features of the Services.

Do Not Track

Some browsers offer a “Do Not Track” (“DNT”) setting. Because there is no common industry standard for interpreting DNT signals, the Services do not currently respond to DNT signals. We do, however, honour Global Privacy Control signals as described above.

Marketing and Communications

Transactional Communications

The Company may send communications necessary to process or fulfil an order, provide customer support, communicate order updates or changes to the Services, administer transactions or address other matters relating to the services requested by you.

Email

With your consent where required, the Company may send you promotional emails about our menu, offers, events and rewards. Every promotional email will include an unsubscribe link, and we will honour unsubscribe requests within ten (10) business days, in accordance with the CAN-SPAM Act.

Text Messages

If you provide your mobile telephone number (including when enrolling in the rewards programme, for which a telephone number is required), we will use it to identify your account to send transactional and programme-related messages. We will send you recurring automated marketing text messages only if you have separately given your prior express written consent. Consent is not a condition of any purchase or of enrolment in the rewards programme. Message frequency varies. Message and data rates may apply. You may also revoke consent by any reasonable means. Mobile information (including your telephone number and text-message opt-in data and consent) will not be shared with third parties or affiliates for their own marketing or promotional purposes.

Push Notifications

Where a Hocco-branded mobile application sends push notifications, you may turn them off at any time through your device settings.

Effect of Opting Out

Opting out of promotional or marketing communications will not necessarily prevent the Company from sending transactional, service-related or other non-promotional communications that are necessary to fulfil an order, administer a transaction, provide requested services or comply with applicable law.

Rewards Programme and Notice of Financial Incentive

The Company offers a rewards and loyalty programme (the “Rewards Programme”), which is governed by this Policy and by the Rewards Programme Terms. To enrol, you must provide your telephone number. You may also choose to provide your first and last name, email address, postal address, city, state, ZIP code and date of birth. In exchange, members may receive points on qualifying purchases, rewards, birthday offers and members-only promotions.

Because the Rewards Programme involves the collection of personal information in exchange for benefits, it may be considered a “financial incentive” or a “bona fide loyalty programme” under certain state laws. The Company has determined in good faith that the value of a member’s personal information is reasonably related to the value of the benefits offered. It estimates that value by reference to the expenses related to the Rewards Programme, including the cost of rewards and offers provided to members.

Personal information collected through the Rewards Programme is used to administer the programme and for the other purposes described in this Policy. It is disclosed to the Master Franchisee, Franchised Restaurants and service providers only as needed to operate the programme. It is not sold to third parties for their own purposes. You may opt in by enrolling and may withdraw at any time by contacting us as described under “Contact Us” or by following the instructions in the Rewards Programme Terms. If you withdraw or ask us to delete your information, you may lose unredeemed points or rewards, as described in the Rewards Programme Terms.

Retention of Personal Information

The Company shall retain personal information for no longer than reasonably necessary for the purposes for which it was collected, taking into account the nature and sensitivity of the information, the purposes of processing, operational requirements, legal obligations, dispute resolution, fraud prevention and the establishment or defence of legal claims.

Different categories of information are retained for different periods. For example, we generally retain: order and financial transaction records for up to seven (7) years for tax and accounting purposes; Rewards Programme account information for as long as your account is active and for up to [twenty-four (24)] months after it becomes inactive; marketing preferences and consent records for up to [five (5)] years after consent is withdrawn; franchise enquiries for up to [three (3)] years; contact and catering enquiries for up to [two (2)] years; and analytics and session-replay data in accordance with the relevant provider’s retention settings, generally not exceeding [thirteen (13)] months. We may retain information for longer where required by law or needed to establish, exercise or defend legal claims.

International Data Transfers

The Company is part of the HOCCO group, which is headquartered in India. Personal information may be accessed from, transferred to, stored in and processed in India and other countries where our affiliates and service providers operate. Those countries may have data protection laws different from those of your state. Where we transfer personal information, we take reasonable steps to ensure that it continues to be protected in accordance with this Policy and applicable law.

Children’s Privacy

The Company’s Services are intended for a general audience and are not directed at children under the age of 13. The Company does not knowingly collect personal information from children under 13. If verifiable parental consent is required by applicable law, including the Children’s Online Privacy Protection Act (“COPPA”) and its implementing regulations, the Company will not collect such information without it. You must be at least [13] years of age to enrol in the Rewards Programme.

Where applicable state privacy laws provide additional protections for minors, including requirements relating to consent, targeted advertising or the processing of personal information, the Company shall comply with such requirements.

If the Company becomes aware that it has collected personal information directly from a child under 13 in circumstances requiring parental consent without obtaining such consent, it shall take reasonable steps to delete the information, unless retention is permitted or required by applicable law.

A parent or legal guardian who believes that a child has provided personal information to the Company may contact the Company using the contact details provided in this Policy to request review or deletion of such information, subject to applicable legal requirements.

Data Security

The Company takes reasonable measures appropriate to its operations to protect personal information against unauthorised access, disclosure, alteration, loss and misuse.

These measures include administrative, technical and physical safeguards such as access restrictions, encryption of data in transit, appropriate contractual controls and oversight of service providers.

No method of transmission or electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.

The Company will assess and respond to suspected personal-information security incidents in accordance with applicable law and relevant contractual obligations. Where legally required, affected individuals and relevant authorities will be notified.

Where you create an account, you are responsible for keeping your account credentials confidential and for notifying us promptly of any unauthorised use of your account.

Consumer Privacy Rights

Depending on your state of residence, the information involved, the relevant processing activity and the applicability of a particular law, you may have rights to:

confirm whether personal information about you is being processed;
access or obtain a copy of your personal information;
correct inaccurate personal information;
request deletion of personal information;
obtain certain personal information in a portable format;
opt out of the sale or sharing of personal information, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects;
withdraw consent where processing is based on consent;
appeal a decision concerning a privacy-rights request, where applicable; and
obtain a list of the categories of third parties, or where required by law, the specific third parties, to which we have disclosed personal information;
receive information concerning certain disclosures or processing activities; and
not be discriminated against for exercising any of these rights.

These rights are subject to applicable statutory requirements, exceptions and limitations. For example, a business may need to retain certain information to complete a transaction, comply with law, maintain required records, detect security incidents or establish or defend legal claims.

How to submit a request

You or your authorised agent may submit a request by emailing privacy@hocco.us with the subject line “Privacy Request.” Please state the right you wish to exercise and your state of residence.

Verification

We will verify your identity before responding to a request to access, correct or delete personal information. We do this by matching the information you provide with information in our records, for example by sending a one-time code to the telephone number or email address associated with your Rewards Programme account. We do not require verification for opt-out requests, but we may deny a request we reasonably believe to be fraudulent.

Authorised agents

If an authorised agent submits a request on your behalf, we may require written proof of the agent’s authority and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Timing

We will respond to a verified request within forty-five (45) days of receipt. Where reasonably necessary, and as permitted by law, we may extend this period by a further forty-five (45) days, in which case we will notify you.

Appeals

If we decline to take action on your request, you may appeal our decision by emailing privacy@hocco.us with the subject line “Privacy Request Appeal” within a reasonable period after receiving our decision. We will respond to your appeal in writing within sixty (60) days, explaining the reasons for our decision. If your appeal is denied, you may contact the Attorney General of your state of residence.

Non-discrimination

We will not deny you goods or services, charge you different prices or provide a different level of quality because you exercised your privacy rights. However, if you ask us to delete information needed to administer your Rewards Programme account, we may be unable to continue your participation, as permitted by law.

Third-Party Websites and Services

The Services may contain links to websites or services operated by third parties. Their privacy practices are governed by their own notices and terms. The Company does not control the independent privacy practices of third parties. You should review their privacy notices before providing personal information directly to them.

State-Specific Privacy Disclosures

Residents of Virginia, Texas, Illinois, Georgia, Ohio, South Carolina and other states may have rights and protections under applicable state laws relating to personal information, data privacy, data security, breach notification and consumer protection. The availability and scope of those rights depend on the applicable law, including its applicability thresholds and exemptions and the nature of the personal information and processing involved. In addition:

California

Under the California Online Privacy Protection Act, this Policy describes the categories of personal information we collect, the categories of third parties with whom we share it, how you can review and request changes to your information, how we respond to Do Not Track signals and how we notify you of material changes. Under California Civil Code Section 1798.83 (“Shine the Light”), California residents may request information about our disclosure of personal information to third parties for their own direct marketing purposes. We do not make such disclosures. To the extent the California Consumer Privacy Act applies to the Company, California residents have the rights described under “Consumer Privacy Rights”, including the rights to know, delete and correct, to opt out of sale and sharing, and to non-discrimination. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use.

Nevada

Nevada residents may submit a request directing us not to sell covered information, as defined under Nevada law, by contacting us as described under “Contact Us”. We do not currently sell covered information as defined under Nevada law.

Washington and Nevada consumer health data

We do not intend to collect consumer health data. To the extent any allergy, dietary or similar information you provide is consumer health data under applicable law, we collect and use it only to provide the product or service you requested.

The Company encourages consumers who have concerns or complaints regarding the handling of their personal information or a suspected privacy or data security incident to contact the Company through the “Contact Us” facility or the contact details provided in this Policy. The Company shall review and investigate complaints received, take appropriate remedial steps where warranted and, where reasonably practicable and appropriate, seek to resolve the matter amicably and in accordance with applicable law.

Changes to This Policy

The Company may update this Policy to reflect changes in its business, Services, data practices, service providers or applicable law. The updated version will be posted on the relevant website with a revised “Last Updated” date. Where required by law, we will provide additional notice or obtain consent before implementing material changes.

Contact Us

For questions, complaints or requests concerning this Privacy Policy or our handling of personal information, contact:

HOCCO Foods USA LLC
Doing business as Hocco – The Indian Kitchen
Privacy contact: Privacy Officer
Email: privacy@hocco.us
Postal address: 1100 Mill Creek, Greensboro, Georgia 30642, USA

Please do not send full payment card details or other unnecessary sensitive personal information in a privacy request.