Supplemental State-Specific Privacy Notice

Access and Deletion Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting selling, or sharing that personal information.
• The categories of third parties with whom we disclose that personal information.
• The specific pieces of personal information we collected about you.
• If we sold, shared, or disclosed your personal information for a business purpose, three separate lists disclosing:
• the categories of personal information that we collected about you;
• sales or sharing (if any), identifying the personal information categories that each category of third parties to whom the personal information was sold or shared; and
• disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Likewise, you have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
• Conduct internal research to improve, repair, or develop products, services, or technology.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech rights, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and compatible with the context in which the consumer provided the information.
• Protect the vital interests of you or of another individual.
• Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, or malicious, deceptive, or illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action.
• Comply with federal, state, or local laws, rules, or regulations.
• Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities.
• Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local law.
• Investigate, exercise, prepare for, or defend actual or anticipated legal claims.

Further, you have the right to request a business that maintains inaccurate personal information about you to correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. Once we receive and confirm your verifiable consumer request, and taking into account the foregoing, we will use commercially reasonable efforts to correct the inaccurate personal information as directed by you.

Last, under Oregon law only, Oregon residents have the right to request a list of specific third parties with whom we disclose personal data. In response, except where a valid exception under Oregon law applies, we may provide a list of third parties, excluding natural persons, to whom we have disclosed (a) your personal data, or (b) any personal data (in each case, as defined under the Oregon Consumer Privacy Act).

You may exercise the rights discussed herein by submitting a verifiable consumer request to us by either:

• Visiting us at https://togrp.com/
• Calling us toll-free at: 1-888-710-5010
• Emailing us at privacy@togrp.com

Only you, or a person legally entitled to submit a request on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

We reserve the right to refuse to provide or to charge for data requests to the extent permitted by applicable law. Each request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you (to the extent required under applicable law). Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

We ordinarily respond to a verifiable consumer request within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Unless otherwise requested, any disclosures we provide will only cover the 12 month period preceding the verifiable consumer request’s receipt. You may request that we disclose certain information to you about our collection and use of your personal information beyond the past 12 months. We, however, may decline to provide you that information if doing so would require a disproportionate effort on our part. The response we provide will also explain the reasons we cannot comply with a request, if applicable. As necessary, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless permitted by applicable law if it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Personal Information Sales and Sharing Opt-Out

You also have the right to direct us to not sell or share your personal information at any time, or to opt out of the processing of your personal information for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the customer (the “right to opt-out”). We do not collect, use, sell, or share the personal information of consumers we know to be less than 16 years of age.

To opt-out of the sharing or selling of personal information by submitting a request on this website, please use the following link:

Do Not Sell or Share My Personal Information

You may also use any other method described in this notice to exercise your rights.

We use any personal information collected from you in connection with the submission of your opt-out request solely for the purposes of complying with the opt-out request.

Once you have opted out, we are required to wait at least 12 months before asking whether you have changed your mind.

California Only: Right to Limit Use of Sensitive Personal Information

The ONE Group may use Sensitive Personal Information (as categorized by the laws of the state of California, but not other states) as a part of its product and service offerings.

Pursuant to the CCPA, California consumers have a right to request a business limit use of “sensitive personal information” about them that The ONE Group has collected or maintained. “Sensitive personal information” includes (1) (A) A consumer’s social security, driver’s license, state identification card, or passport number; (B) A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) A consumer’s precise geolocation (1850 ft radius); (D) A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication; (F) A consumer’s genetic data. (2) (A) The processing of biometric information for the purpose of uniquely identifying a consumer; (B) Personal information collected and analyzed concerning a consumer’s health; and (C) Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. The ONE Group will treat a request to limit our use of sensitive personal information as a request to delete.

To take advantage of your right to limit The ONE Group’s use of sensitive personal information which we will treat as a request to delete, you may submit a request here: privacy@togrp.com.

You may also use any other method described in this notice to exercise your rights.

California Only: Notice of Financial Incentives

The One Group provides a rewards program known as Friends with Benefits. In order to participate in Friends with Benefits, you may be required to provide personal information to us. Friends With Benefits is intended to keep you updated on offers, promotions and news regarding The One Group and its various restaurant brands. Consumers who sign up for Friends with Benefits may from time to time be offered free food or drinks, special offers, coupons and other discounts.

Participation in Friends with Benefits requires that you create an account and agree to our Terms of Use and the Friends with Benefits Terms and Conditions, accessible at the following link: https://togrp.com/friends-with-benefits-rewards-terms-of-use/. You can sign up for Friends with Benefits at the following link: https://togrp.com/friends-with-benefits-registration/.

The value of the benefits provided as part of participating in Friends with Benefits varies, as individual participants will take advantage of The One Group’s financial incentive offerings in different ways. The One Group estimates that the value of consumers’ personal information provided in connection with Friends with Benefits is equivalent to the relevant expenses related to the collection and storage of that personal information. Any difference in price or benefits provided to participants in Friends with Benefits is reasonably related to the value of the personal information provided, considering the fact that the primary purpose of providing Friends with Benefits is to offer discounts and other benefits to our participating customers.

Nevada Only: No Sale of Personal Information

The ONE Group’s use of personal information does not constitute a sale under Nevada law. If you have questions or if you would like to receive notice by email in the event The ONE Group should engage in “sales” of personal information under Nevada law in the future, please opt out of our selling or sharing your personal information here, or call 1-888-710-5010.

Colorado Only: Colorado Privacy Act Profiling Disclosure

The ONE Group does not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act.

Appeals Process

The ONE Group provides eligible consumers a formal method for appealing The ONE Group’s refusal to take action on a request for access, deletion, correction, opt-out, or any other right afforded by state privacy laws. An appeal may be submitted by emailing privacy@togrp.

You may also file a complaint with your state’s Attorney General, where applicable under state law.

Discrimination Protections

We will not discriminate against you for exercising any of your rights. Unless permitted by applicable law, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
• Retaliate against an employee, applicant for employment, or independent contractor for exercising their rights.

However, we may offer you certain financial incentives permitted by the applicable law that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time. Except as expressly stated in connection with our Friends with Benefits loyalty program, we do not currently provide any financial incentives.

De-identified Data Disclosure. The ONE Group may use de-identified data in some instances. The ONE Group either maintains such data without attempting to re-identify it or treats such data as personal information subject to applicable law, unless such data is publicly available information and therefor would not be personal information under applicable law even without de-identification.

California’s “Shine The Light” Disclosure

California Civil Code Section 1798.83, known as the “Shine The Light” law, permits any users who are California residents to request and obtain from us a list of what personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year and the names and addresses of those third parties. Requests may be made only once a year and are free of charge.

Information for California Consumers

You may contact the California Attorney General (https://www.oag.ca.gov), or the California Privacy Protection Agency (https://www.cppa.ca.gov), for more information.

Information for Colorado Consumers

You may contact the Colorado Attorney General for more information.  Please visit https://coag.gov/

Information for Connecticut Consumers

You may contact the Connecticut Attorney General for more information.  Please visit https://portal.ct.gov/ag

Information for Delaware Consumers

You may contact the Delaware Attorney General for more information. Please visit https://attorneygeneral.delaware.gov/

Information for Iowa Consumers

You may contact the Iowa Attorney General for more information. Please visit https://www.iowaattorneygeneral.gov/

Information for Montana Consumers

You may contact the Montana Attorney General for more information. Please visit https://dojmt.gov/attorney-generals-office/

Information for Nebraska Consumers

You may contact the Nebraska Attorney General for more information. Please visit https://ago.nebraska.gov/

Information for Nevada Consumers

You may contact the Nevada Attorney General for more information. Please visit https://ag.nv.gov/

Information for New Hampshire Consumers

You may contact the New Hampshire Attorney General for more information. Please visit https://www.doj.nh.gov/

Information for New Jersey Consumers

You may contact the New Jersey Attorney General for more information. Please visit https://www.njoag.gov/

Information for Oregon Consumers

You may contact the Oregon Attorney General for more information.  Please visit https://www.doj.state.or.us/

Information for Texas Consumers

You may contact the Texas Attorney General for more information.  Please visit https://www.texasattorneygeneral.gov/

Information for Virginia Consumers

You may contact the Virginia Attorney General for more information. Please visit https://www.oag.state.va.us/

Information for Utah Consumers

You may contact the Utah Attorney General for more information. Please visit https://www.attorneygeneral.utah.gov/

Last Updated: July 25th, 2025.