Privacy Policy

Last Updated and Effective Date: October 17, 2023

Privacy Policy

This Privacy Policy describes how Performance Food Group, Inc. and its subsidiaries (“we” or “us”) use, disclose, and process consumers’ (“you” and “your”) Personal Information (defined below). Your continued use of our website means that you understand and accept the terms of this Privacy Policy. We reserve the right to change this Privacy Policy at any time. If we change our Privacy Policy, we will post an updated version on this website. Please check back periodically to see if our Privacy Policy has been updated. Updates to the Privacy Policy will be referenced by the “Last Updated and Effective Date” date shown above.

1.Definitions .*

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household. “Personal Information” does not include: (i) publicly available information or lawfully obtained, truthful information that is a matter of public concern; or (ii) information that is deidentified or aggregate information.

“Sensitive Personal Information” means Personal Information that reveals information such as: (a) social security, driver’s license, state identification card, or passport number; (b) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) precise geolocation; (d) racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of an mail, email, and text messages unless we are the intended recipient of the communication; (f) genetic data; (g) information about a known child, (h) mental or physical condition or diagnosis, (i) sex life or sexual orientation, (j) status as transgender or nonbinary, (k) status as a victim of crime, (l) citizenship or immigration status, and (m)biometric information for the purpose of uniquely identifying an individual. Sensitive Personal Information that is publicly available is not considered Sensitive Personal Information or Personal Information.

* Please note that various jurisdictions may use different terms. For example, some jurisdictions use the terms “personal data” or “sensitive personal data”.

2.Information We Collect,How We Collect it, and Why.

Set forth below are the categories of Personal Information we collect and that have collected in the preceding 12 months, the categories of sources from which the Personal Information was collected and the business or commercial purpose for such collection. Please note that we may not collect all of the Personal Information referenced below regarding you and we may not use the Personal Information that we collect from you for all of the purposes that are listed.

*SeeSection 3, below.

** Some jurisdictions refer to service providers as processors or data processors.

3.Cookies and Other Technology.

As noted above, we use cookies and other related technologies. A brief explanation is set forth below.

• Cookies: A “cookie” is an element of data that a website can send to your browser, which may then be stored it on your computer system. It can help provide you with a tailored user experience, to understand your preferences and to personalize the content you see.

If you do not want cookies placed on your device when browsing our sites, you can disable them. You can set your browser to notify you when you receive cookies, and to block them. These settings are typically found in the ‘Options’ or ‘Preferences’ menu of your internet browser. For more information on how to change your browser settings, click on the ‘Help’ section of your Internet browser. Please be aware that if Cookies are disabled or removed, all features of our sites may not operate as intended.

• Web Beacons and Pixels: Our sites may use web beacons and pixels (such as Meta Pixel), which are images that can be placed in web pages and some forms of email. These technologies can be used to deliver cookies and to collect information about your use of the site. For example, we may use web beacons to count the number of your visits to the site.

Our Sites may also collect information through tracking pixels. A tracking pixel is a transparent graphic image (usually 1 pixel x 1 pixel or Javascript tag) that is placed on a web page and, in combination with a cookie, allows us to collect information regarding the use of the page of the site that contains the tracking pixel. We may use tracking pixels to trigger ads on participating websites based on activity tracked from the browser on a device used to visit our Sites.

Other entities may have access to some of this information.

• Referrers: A "referrer" is the information passed along by a web browser that references the web URL from which you come to the site. Referrers are automatically collected by our web servers. They may be used by our sites to identify the websites referring traffic to our site, to identify the information on our sites that are viewed by individuals referred by certain websites and to present appropriate content to the users. Referrer information may be used by us to identify general trends and traffic patterns.
• IP Addresses: IP addresses are used by your computer every time you are connected to the Internet. Your IP address is a number that is used to identify your computer so that data (such as the web pages you request) can be sent to you. They are automatically collected by our web servers.
• System Information: System information we may collect may include, among other things, the type of web browser being used. This information is sent automatically by your web browser when you are connected to our sites and is used by us only for identify broad demographic statistics and general trends and traffic patterns.
• Future Technologies and Methods: As technologies change, we may collect information in different ways. However, we will continue to treat all Personal Information that we collect in this manner as outlined above, unless we modify this Privacy Policy.

4.How We Disclose Personal Information to Our Service Providers and Contractors .

We disclose Personal Information to our service providers or contractors, which are entities that use your Personal Information for own purposes only, for the reasons set forth below. Please note that we may not disclose all of the Personal Information regarding you to service providers or contractors for the purposes set forth below.

• Auditing of Ad Impression: We disclose Personal Information for auditing purposes related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Security and Fraud Detection: We disclose Personal Information for our security and fraud detection services including detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity.
• Functionality & Debugging: We disclose Personal Information to engage in debugging to identify and repair errors that impair existing intended functionality.
• Short-Term / Transient Use: We disclose Personal Information for short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the consumer’s Personal Information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.
• Services on Our Behalf: >We disclose Personal Information in order to receive services performed on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf.
• Advertising and Marketing Services: We disclose Personal Information to provide advertising or marketing services on our own behalf.
• Research & Development: We disclose Personal Information for internal research related to technological development and demonstration.
• Quality Control & Improvement of Products and Services: We disclose Personal Information to verify, maintain, and improve our products and services.

The following chart sets forth the categories of Personal Information we have disclosed to our service providers for a business purpose over the past 12 months.

As Necessary: We may also disclose Personal Information, as necessary: (a) to comply with any legal process; (b) to respond to requests from public and government authorities; (c) to enforce our terms and conditions; (d) to protect our operations and protect our rights, privacy, safety or property, and/or that of you or others; and (e) to allow us to pursue available remedies or limit the damages that we may sustain. We may also use Personal Information in connection with or during negotiation of any reorganization, acquisition, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We only use Sensitive Personal Information for purposes disclosed herein.We do not use or disclose Sensitive Personal Information for purposes other than those specified herein.

5.Personal Information We Sell and/or Share for Targeted Advertising.

We do not “sell” your Personal Information as that term is commonly understood (i.e., selling your Personal Information in exchange for money). However, we may disclose Personal Information to certain third parties under circumstances that may constitute a sale of that information under some laws. For example, disclosure of your Personal Information to another party who can use it for its own purposes can be deemed a sale under certain laws. In addition, some of our technology providers, such as our third-party data analytics partners like Google Analytics or Meta Pixel, may have access to your data for their own benefit, which may be considered a sale under certain state laws.

We may also share certain Personal Information for purposes of cross-context behavioral advertising (targeted advertising).

The chart below describes the Personal Information we have sold (under this broader definition) or shared (for targeted advertising) in the past 12 months, the categories of third parties to which we have sold or shared the information, and the applicable business purpose. Please note that we may not disclose all of the Personal Information regarding you to these entities.

We use third party cookies to collect information for analytics purposes and to place targeted advertisements.

We use third party advertising companies to place ads. We do this by allowing our advertising and social media partners to place their cookies on a browser of an individual who visits our sites. The data received by our third party advertising and social media partners allows them to measure the effectiveness of such advertising and to provide advertisements on other websites about our services which are tailored to your interests.

As noted, we use Google Analytics to ensure website functionality and improve our website and services. This software may record information such as your IP address, location, age and gender, browser type and language, operating system, access time, duration of visit, pages you view within our website, search terms you enter and other actions you take while visiting us, the pages you view immediately before and after you access the services, how often you use our Services, aggregated usage and performance data, app errors and debugging information. Google Analytics is owned and controlled by Google LLC. Data collected by Google is subject to its privacy policy. To learn how Google uses data related to website analytics, please click here [Link: https://policies.google.com/technologies/partner-sites]. You may opt-out of having your activity on our website made available to Google Analytics by installing the Google Analytics browser add-on, available here [Link: https://tools.google.com/dlpage/gaoptout].

As further noted, we use Meta Pixel. Meta Pixel is a piece of code on your website that can help us better understand the effectiveness of our advertising and the actions people take on our sites, like visiting a page or adding an item to their cart. We may also be able to see when customers take an action after seeing our ad on Meta platforms, such as Facebook and Instagram, which can help us with retargeting.

We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age .

6.Our Retention Policy

We will retain each category of your Personal Information identified above for an amount of time that is reasonably necessary for us to use the information for the purposes disclosed herein and for any other permitted purposes, including retention of Personal Information pursuant to any applicable contract, law or regulation. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

7.Children.

We do not direct our websites or applications to children under thirteen (13) years of age. We do not knowingly collect information from persons under 13 years of age or provide any personal information from such persons to any third party for any reason whatsoever. We do not allow persons known to be under 13 years of age to receive direct marketing communications from us. No information should be submitted to our websites or applications by persons under 13 years of age. When appropriate, we may ask you to indicate your date of birth to verify compliance with the age requirements set forth herein.

8.Your Rights if You Are a Resident of California.

California residents may exercise certain privacy rights pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2023, and related regulations. Your right to submit certain requests as a California resident are described below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms.

• Right to Know Personal Information Collected About You. You have the right to know: (1) the categories of Personal Information we have collected about you; (2) the categories of sources from which the Personal Information is collected; (3) the business or commercial purpose for collecting, selling, or sharing Personal Information; (4) the categories of third parties to whom we disclose Personal Information; and (5) the specific pieces of Personal Information we have collected about you. You also have the right to know the list of all third parties to whom we have disclosed Personal Information, as defined under California Civil Code Section 1798.83(e) (a/k/a the “Shine the Light Law”), during the preceding year for third-party direct marketing purposes. You may submit a request by calling us at 1-800-473-4434 or emailing us at [email protected].
• Right to Know Personal Information Disclosed, Sold or Shared and to Whom .You have the right to request that we disclose to you: (1) the categories of Personal Information that we collected about you; (2) the categories of Personal Information that we sold or shared about you and the categories of third parties to whom the Personal Information was sold or shared, by category or categories of Personal Information for each category of third parties to whom the Personal Information was sold or shared; and (3) the categories of Personal Information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose. You may submit a request by calling us at 1-800-473-4434 or emailing us at [email protected].
• Right to Request Deletion of Your Personal Information. You have the right to request that we delete your Personal Information, subject to a number of exceptions. Following receipt of a request, we will let you know what, if any, Personal Information we can delete from our records. If we cannot delete all of your Personal Information, we will let you know the reason. You may submit a request by calling us at 1-800-473-4434 or emailing us at [email protected].
• Right to Correct Inaccurate Information. If you believe that any of the Personal Information we maintain about you is inaccurate, you have the right to submit a request for us to correct that information. Upon receipt of a request, we will use commercially reasonable efforts to correct the information as you direct. You may submit a request by calling us at 1-800-473-4434 or emailing us at [email protected].
• Right to Opt-Out of the Sale and Sharing of Your Personal Information . You may opt-out of the sale or sharing of your Personal Information, to the extent appliable, by clicking here: [Link: Do Not Sell or Share My Personal Information Hyperlink].
• Right to Limit the Use of Your Sensitive Personal Information . You have the right to limit the use of Sensitive Personal Information under circumstances. You do not have this right where we use your Sensitive Personal Information for the following purposes: (i) to that use which is necessary to perform the services or provide the goods reasonably expected by you; (ii) to help to ensure security and integrity; (iii) to perform services on our behalf; (iv) to undertake activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us; and (v) to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us. Given how we use your Sensitive Personal Information, as described above, this right does not apply to you.
• Right to Non-Discrimination for Exercising Your Rights.If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.

When you make a request to know, delete and/or correct, to help protect your privacy and maintain security, we will take steps to verify your identity. Our verification procedure may differ depending on whether you have an account with us or not and the request you are making. The following generally describes the verification processes we use:

• Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with a request to know or delete.

• Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
• For requests to know categories of Personal Information , we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you with reliable data points maintained by us.
• For requests to know specific pieces of Personal Information , we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us. We will also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request or that person’s authorized representative. We will maintain all signed declarations as part of our records.
• For requests to correct or delete Personal Information , we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the Personal Information and the risk of harm posed by unauthorized deletion. We will act in good faith when determining the appropriate standard to apply.

If there is no reasonable method by which we can verify your identity, we will state so in response to a request to know or delete Personal Information, including an explanation of why we have no reasonable method to verify your identity.

If you use an authorized agent to submit a request to know, delete or correct, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; or (b) directly confirm with us that you provided the authorized agent permission to submit the request. This requirement does not apply if you have provided the authorized agent with power of attorney pursuant to California Probate Code sections 4121 to 4130.

We will respond to requests to know, requests to delete and / or delete no later than 45 calendar days. If we cannot verify your request within 45 days, we may deny your request. If necessary, we may take up to an additional 45 days to respond to your request but in such an event will provide you a notice and an explanation of the reason that we will take more than 45 days to respond to your request.

Regarding your rights to opt-out of the sale and sharing of Personal Information and to limit the use of your Personal Information, in addition to the links above, you can also exercise your right to opt-out by using a browser that supports an opt-out preference signal (also known as a Global Privacy Control (GPC)). If you choose to use this signal, you will need to turn it on for each browser you use.

9.Your Rights If You Are a Resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Florida or Montana .

If you are a resident of Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Florida, or Montana, (except as noted below), you may have, or may soon have, certain additional rights set forth below. The rights of the residents of the states of Colorado, Connecticut and Virginia are currently in effect. The rights of the residents of the state of Utah go into effect on December 31, 2023. The rights of the residents of the states of Florida, Oregon and Texas go into effect on July 1, 2024, and the rights of the residents of the state of Montana go into effect on October 1, 2024.

Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms.

The Right to Know: You have the right to know whether we are processing your personal information, and, if you are a resident of Oregon, the categories of your Personal Information we have processed and the specific third parties to which we have disclosed it.

The Right of Access: You have the right to access your personal information, and to obtain a copy of it in a readily usable format, if feasible.

The Right to Correct Inaccuracies: You may request that inaccuracies in your personal information be corrected. Utah law does not provide for this right.

The Right to Delete: You have the right to request that your personal information be deleted, except in cases where retention is required by law or contractual obligation.

The Right to Data Portability: You have the right to obtain a copy of your data in a portable and, if feasible, readily usable format.

The Right to Opt-Out: You may elect to prevent your personal information from being:

(1) Used in targeted advertising;

(2) Sold;

(3) *Used for profiling purposes that may produce legal or similarly significant effects.

* Utah law does not provide for this right.

The Right to Non-Discrimination for Exercising Your Rights: If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.

Rights Regarding Sensitive Personal Information: In connection with your Sensitive Personal Information: (a) if you are a resident of Utah or Oregon, we will not process that information without first presenting you with clear notice and an opportunity to opt out of the processing; and (b) if you are a resident of Colorado, Connecticut, Florida, Montana, Texas or Virginia, we will not process Sensitive Personal Information without obtaining your consent. You have the right to withdraw your previous consent and opt out of further processing of your Sensitive Personal Information.

Furthermore, if we have actual knowledge that you are 13 years of age and not older than 16 years of age, we will not without your consent process your Personal Information for the purposes of targeted advertising, profiling in furtherance of decisions that produce legal effects or effects of similar significance or selling your Personal Information.

You may submit a request via email to [email protected] or by calling us at 1-800-473-4434. Information requests under “Right of Access” will be transmitted securely. If we cannot fulfill your request, we will notify you of that decision and the reasons why within 45 days. At that point if you believe our decision was in error, you can submit an appeal using the method(s) above. If the result is the same, you can also seek assistance and/or redress from your state attorney general.

10.Nevada Privacy Notice.

Nevada law provides that Nevada residents may opt-out of the “sale” of “covered information” to third parties, including but not limited to name, address, social security number, and online service activity. Our uses of your personal information are not sales under Nevada law, so no opt-out right applies.

11.How to Contact Us.

If you have any questions or concerns about our privacy policies and practices, please feel free to contact us by calling us at 1-800-473-4434, emailing us at [email protected] or by mail at Performance Food Group, 12500 West Creek Parkway, Richmond, VA 23238.