Chipotle Applicant Privacy Notice 

Last Updated: August 27, 2024

CMG Strategy Co., LLC and its subsidiaries and affiliates (collectively, “we”, “us”, or “Chipotle”) provide this Applicant Privacy Notice applicable to users of our Careers site. Because we gather certain types of information about applicants during the recruitment process, we want to help you understand our practices surrounding the collection, use and disclosure of your personal information.

Para ver este aviso en Español, haga clic aquí.
Veuillez cliquer ici pour consulter cet Avis en français.
Um diese Mitteilung auf Deutsch zu lesen, klicken Sie hier.

As a food-focused, people-first company, our mission of Cultivating a Better World means more than just using real ingredients. It means hiring passionate people and investing in their future. It means championing diversity and celebrating inclusion. It means fostering a culture of well-being for our employees and the environment. So whether you are seeking to join our team to grow your career, chase your passion or just pick up a few skills along the way, we want to help you get a real start.

This Privacy Notice addresses the following topics:

Scope of This Notice
This Privacy Notice applies only to information collected for recruitment purposes through the Site—inclusive of our chat bot and virtual team member, Ava Cado—and from other sources. The other sources might include information that you provide other than through the online application page or our virtual team member, as well as information obtained, for example, from prior employers, other references, pre-employment screening providers, and educational institutions. This Notice does not apply to personal information about our employees, contractors, customers, or to other personal information that Chipotle collects for other purposes, which is subject to separate privacy policies.

Your Consent
Creating an Account

To submit your job application for most roles within Chipotle, you will be required first to create an account with us. After providing the required account information, you will need to review and acknowledge that you have read our Global Applicant Privacy Notice: “By clicking the “Create Account” button below, I acknowledge that I have reviewed, understand and agree to Chipotle’s Global Applicant Privacy Notice." By clicking “Create Account”, you consent to the collection, use, disclosure, transfer across borders and other processing of your personal information as described below. Once you agree, your consent will continue to apply to our collection, use, disclosure, cross-border transfer and other processing of your personal information unless you revoke your consent by contacting us at privacy@chipotle.com.

If you click "Decline," you will not be able to proceed to the online application page to apply for global career opportunities within Chipotle, and Chipotle may not be able to consider you for the position for which you wish to apply.

Engaging with our Chat Bot and Virtual Team Member, Ava Cado

If you choose to engage with our chat bot and virtual team member, Ava Cado, you will also be asked to consent to the collection, use, disclosure and transfer across borders or other processing of your personal data. We may record or create transcripts of your chats with Ava Cado, or any other method by which you connect with us and may retain the information disclosed during these interactions to assist you in the future, to improve our recruiting process, to meet our legal obligations or to protect our legal interests, as well as for other business purposes that are detailed in this Notice. We may also use vendors to provide these services which means these vendors may have to access to these recordings or transcripts, including in real time. By using Ava Cado, you consent to Chipotle’s monitoring and recording of the chat and to the collection and analysis of all personal information provided through the chat, and you authorize Chipotle to disclose to and share with our service provider any personal information you provide. If you do not consent to Chipotle’s collection and analysis of your data or to the processing of this data by our service provider on Chipotle’s behalf, then please do not use Ava Cado.

Mobile Terms
The Ava Cado short code program (“Ava Cado”) is used to communicate with job candidates, applicants, and employees about recruitment and employment related inquiries via SMS. Users can opt-in by selecting “email and text message” as their preferred communication method during the application process, or texting the advertised keyword to “CHIPJOBS” or “21414”

Once you have opted-in to Ava Cado, you can opt-out or cancel SMS messages from Ava Cado at any time by texting “STOP” to “CHIPJOBS” or “21414”. After you text “STOP” to “CHIPJOBS” or “21414” you will receive one additional SMS message to confirm that you have been unsubscribed. If you would like to join or opt-in again, you can sign back up for Ava Cado by texting the advertised keyword to “CHIPJOBS” or “21414”and you will start receiving SMS messages from Ava Cado again.

If you experience issues with Ava Cado you can respond to a message from Ava Cado with the word “HELP” or text “HELP” to “CHIPJOBS” or “21414” for assistance. You may also contact us for help at privacy@chipotle.com.

Carriers are not liable for delayed or undelivered messages. Message and data rates may apply for any messages sent to you from Ava Cado, and to Ava Cado from you. Message frequency varies. If you have any questions about your text plan or data plan, please contact your wireless provider.

Personal Information We Collect About You
If you choose to apply for a position with us, the categories of personal information that we may collect about you through the Site and other sources are listed below. Please remember that you are responsible for providing information that is accurate, complete and up to date when you disclose information to us during the employment process.

 

 

·       Identifiers: Name, alias, postal or mailing address, email address, telephone number, username and password for Chipotle job applicant account, and any required security or access code, password, or credentials allowing access to your Chipotle job applicant account, last four digits of your Social Security number, and date of birth. We may also collect your driver’s license or state identification card number, passport number, or immigration status and related documents (e.g., green card, visa, permanent resident card), to the extent permissible.

 

·       Professional or Employment-Related Information: (a) information provided in your job application or resume; (b) your employment history (e.g., dates and locations of employment and last position held); (c) educational history (e.g., institutions attended, degrees earned, and certifications obtained); (d) salary history or expectations (where permissible) (e) vocational certifications or other certifications, training courses, licenses obtained/held, or professional memberships; (f) information you disclose when applying through social media (e.g., TikTok, LinkedIn, Discord, etc.), including photo and video submissions; and (g) and any other information you provide about relevant skills, qualifications, experience, publications, or speaking engagements.

 

·       Non-public educational information: For example, information in transcripts or records of degrees.

 

·       Sensory or Surveillance Data: for example, voicemails, audio/visual recordings of interviews, and footage from video surveillance cameras. In addition, if you contact us with a comment, question or complaint, or inquire about or apply for a job either by phone or online through our virtual team member Ava Cado, we may record or create transcripts in real time of these calls, chat sessions, or any other method by which you connect with us. Chipotle, and our service providers used to provide these services, may access and store this information for purposes of assisting you, to improve our services, and to meet our legal obligations. Please find more information in the Consumer Privacy Notice applicable to your jurisdiction (US, Canada, EU/UK) in the section on “Collection of Information” to learn about how we handle information collected in this method. By contacting us, you consent to the collection, use, and disclosure of this information.

 

·       Medical Information: If the Company conducts a post-offer medical examination or if you request an accommodation in connection with the hiring process, we may collect medical information about you.

 

·       Geolocation Data: You may be asked to consent to sharing your general location data to help us provide matches to jobs near you. We do not collect your precise geolocation.

·       Inferences: For example, the Company may infer characteristics about applicants’ predispositions, behavior, abilities, and aptitudes during the hiring process, based on other personal information collected.

 

·       Internet or Other Similar Network Activity: We may collect information regarding your interaction with the Site, including through the use of cookies and similar technologies. Please find more information in our Cookie Policy applicable to your jurisdiction (US, Canada, EU/UK), and in our Consumer Privacy Policy applicable to your jurisdiction (US, Canada, EU/UK) in the section on “Information Collected Automatically” to learn about the information we collect automatically using cookies and other technologies when you visit the Site. If you visit our offices during the recruitment process and use our guest WiFi, we may collect information about that use, such as type of device used and start/stop time. We also may collect information from your publicly available social media content.

 

·       Other Information Submitted With Your Application: (a) results of any pre-hire skills assessment or other evaluations; (b) your eligibility to work in the country where you reside; and (c) any other personal information you voluntarily provide over the course of the hiring process, such as work product samples, information in interviews, or Work Opportunity Tax Credit (WOTC) information.

 

Information About Protected Classification: When you apply for a position, you may have the opportunity to provide information about your protected classification, i.e., gender, race/ethnic origin and/or veteran status in order for us to conduct equal opportunity monitoring to the extent permitted by applicable laws. The provision of this information is entirely voluntary. If you decline to provide this information, your application(s) will not be affected in any way. If you do choose to provide this information, you consent to our using it for equal employment opportunity monitoring purposes. This information will be held and stored anonymously and will not be used to evaluate your application for employment and also will not be used to infer any characteristics about you.

Except as described above, we will not request or otherwise collect information about your health, race or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or sexual orientation or your genetic information or biometric information through the online application or during the application process unless the law, as an exception, requires us to do so. We, or a third-party background check company under our direction, may check employment references, and criminal history records for information about convictions, but only if and to the extent permitted by applicable law.

Categories of Sources of Your Personal Information

We may collect the categories of personal information listed above from the following sources:

  • You, for example, in your job application, forms you fill out for us, assessments you complete, surveys you complete, and any information you provide us during the course of your application and interview process.
  • Vendors and service providers, for example, recruiters.
  • Third parties, for example, job references, affiliated companies, professional employer organizations or staffing agencies.
  • Public internet sources, for example, social media, job boards, public profiles, and other public online sources. Note that your use of such platforms and the handling of your Personal Information is governed by those platforms’ terms of use and their privacy policies. When we receive your Personal Information as part of your application to Chipotle, our own handling of your Personal Information will follow this Notice.
  • Public records, for example, court records, and credentialing and licensing organizations.
  • Automated technologies on Chipotle’s electronic resources, for example, to track logins and activity on Chipotle’s careers page.
  • Surveillance/recording technologies, for example, video surveillance in common areas of Chipotle facilities, voicemail technologies, webcams, and audio/video recording technologies with consent to the extent required by law.
  • Government or administrative agencies, for example, law enforcement or public health authorities.

How We May Use Your Personal Information

We will use the information that we collect about you for purposes of the hiring process, including:

Recruiting Purposes:

  • To evaluate your qualifications or suitability for employment with us
  • To communicate with you
  • To check your references
  • To conduct a pre-employment or criminal history background check
  • For identification purposes
  • For diversity and inclusion purposes where permitted by applicable law
  • For recordkeeping purposes
  • To demonstrate your agreement to, or acceptance of, documents presented to you, (e.g., pre-employment arbitration agreement, acknowledgment of employment application, offer letter)
  • To evaluate and improve the recruiting process

If you visit our facilities:

  • To make travel arrangements
  • To reimburse travel expenses
  • To manage access to Chipotle facilities
  • To maintain security during the visit
  • To monitor your use of the corporate Internet access if you connect to our guest WiFi, or your use of other Chipotle systems

Other Purposes to Conduct Our Business

  • To manage and operate information technology and communications systems, risk management and insurance functions, budgeting, financial management and reporting, strategic planning
  • To exercise our rights under applicable laws, and to support or defend against administrative charges or legal claims
  • To comply with our legal and regulatory obligations
  • In connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of Chipotle or any of its subsidiaries or affiliates;
  • To protect the rights, property, or safety of Chipotle, applicants, our customers, or others

 

You may also choose to receive job posting notifications by email or text message, informing you of positions that may fit your profile. You can stop receiving job alerts by email at any time by following the “unsubscribe” instructions included in each email or replying STOP to any text message.

Chipotle’s employees involved in the evaluation of your application and, if you are hired, in the administration of your employment relationship with Chipotle will have access to your personal information on a need–to-know basis.

Lawful Basis For Processing: Where applicable information protection law requires a lawful basis for collecting, using and otherwise processing your personal information, Chipotle relies on your consent to do so. The processing of your personal information also is necessary for Chipotle to determine whether to enter into an employment agreement with you. If you do not provide requested information, Chipotle may not be able to consider you for employment. In addition, the processing of your personal information is necessary for Chipotle to pursue its legitimate interests in recruiting and hiring suitable personnel.

How We May Disclose Your Personal Information

Chipotle will not sell, lease, or license your personal information to any third party. There are limited circumstances when Chipotle may disclose the personal information we collect about you to third parties, most notably:

  • Service Providers: With third-party service providers. We may, for example, retain a service provider to host all or portions of this Site, to help maintain and manage our databases, to assist in the recruiting process, or to conduct pre-employment screening. Service providers will be permitted to use your personal information only for the purpose(s) for which it was disclosed to them and in accordance with Chipotle’s instructions. Service providers generally will be located only in the United States or in the country where you are applying for a position;
  • Corporate Affiliates: With affiliated companies, such as grandparent, parent and/or subsidiary corporations, for their recruitment, recordkeeping and/or reporting purposes;
  • Required By Law: When required by law, such as when we respond to subpoenas, court orders, legal process, or a discovery request in civil litigation;
  • Legal Violations: If we believe that your actions violate applicable law, or threaten the rights, property, or safety of our Company, our users, or others;
  • Corporate Transactions: If we sell some or all of our business, we may disclose all of the information that we have collected about you to a purchaser or, in due diligence, to a potential purchaser, but subject to a confidentiality agreement.

Chipotle will make such disclosures only as permitted by applicable information protection laws.

Internal References
As part of our application process, you are given the opportunity to provide the name of any Chipotle employee who referred you to apply for the position for which you are submitting an application through this Site. You are not required to provide an employee reference. If you do submit the name of an internal reference Chipotle will ask that employee: (1) if they referred you to apply; and (2) if they endorse your application. By submitting the name of an internal reference you are confirming that you have received the explicit consent of the Chipotle employee to submit their personal information.

 

Retention Of Your Personal Information
If Chipotle hires you, the information that you submitted through the online application and the information that we collect during the application process will become part of your personnel file and may be used to administer the employment relationship and for related reporting and recordkeeping purposes. Chipotle will retain this information for the entire duration of your employment relationship with Chipotle and for the period thereafter identified in Chipotle’s Global Records Retention Schedule, which is available on Chipotle’s corporate intranet.

Chipotle will retain the information of applicants who are not hired for one year after the hiring decision has been made unless (a) the applicant indicates that we may maintain the information on file until the applicant asks to delete the information, or (b) a shorter or longer retention period is legally required. These records will be retained for our internal recordkeeping and reporting purposes. During that time, we may use your personal information to consider you for positions in addition to the position(s) for which you initially applied. If you wish to withdraw your application from consideration at any time during this retention period, you may delete your application through the Candidate Home page or engage with Ava Cado and request that your application be withdrawn.

Security For Your Personal Information
We want you to feel confident about providing your personal information through the online application page, so we have implemented a security program to keep information that is transmitted to our systems protected from unauthorized access. Your submissions of information to our secure server are protected by Hypertext Transfer Protocol Secure (“HTTPS”) and Transport Layer Security (TLS) technology, utilized by many popular browsers to safeguard transmissions. This technology allows us to use encryption tools to protect information transmitted between your computer and our server. After we have received your information, access to it is limited to employees with a need to know.

While we strive to protect your personal information, we cannot guarantee the security of any information that you submit through the online application, and you do so at your own risk. We urge you to keep your username, password and any other log-in credentials in a safe place as you share responsibility for maintaining the confidentiality of the information that you submit to us. It is a good practice to sign off your account and close your browser window when you have finished your visit to the Site.

Jurisdiction-Specific Information

  • California
  • European Economic Area, and United Kingdom

California

This section applies only to individuals who reside in the state of California in the United States (“California residents”). This section applies to personal information collected through Site and in any other way, such as when California residents visit our offices.

California Notice at Collection: Chipotle collects the categories of personal information identified in the section on “Categories of Sources of Your Personal Information” above, for the purposes identified in the section “How We May Use Your Personal Information” above, and retains personal information for the period described in the section on “Retention of Your Personal Information”. We do not, and will not, sell your personal information or disclose it to third parties for cross-context behavioral advertising. We also do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

Additional Information Regarding Disclosures of Personal Information

The California Privacy Rights Act (CPRA) requires that we provide you with the following information about disclosures of your personal information to third parties for “business purposes”, as that term is defined in the CPRA:

  • Service providers: Chipotle may disclose to service providers any of the categories of personal information listed in the section on “Categories of Sources of Your Personal Information,” above, for the business purpose of performing services on Chipotle’s behalf and, in particular, for the specific purposes described in “How We May Use Your Personal Information”, above.
  • Auditors, lawyers, consultants, and accountants engaged by Chipotle: Chipotle may disclose the categories of personal information listed in the section on “Categories of Sources of Your Personal Information”, above, to these services providers or contractors for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on Chipotle’s behalf.
  • Affiliated companies: Chipotle may disclose any of the categories of personal information listed in the section on “Categories of Sources of Your Personal Information”, above, to other companies within the Chipotle family of companies for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

Your California Privacy Rights

Subject to applicable exceptions, California residents have the following rights under the California Privacy Rights Act (“CPRA”):

  • Right to Know: You have the right to submit a verifiable request for specific pieces of your personal information obtained from you and for information about Chipotle’s collection, use, and disclosure of categories of your personal information.
  • Right to Access: The right to request that we provide you access to or disclose to you the specific pieces of Personal Information we have collected about you;
  • Right to Delete: You have the right to submit a verifiable request to delete personal information that Chipotle has collected from or about you.
  • Right to Correct: You have the right to submit a verifiable request to correct inaccurate personal information about you maintained by Chipotle, taking into account the nature of the personal information and the purposes of processing the personal information.

Non-Discrimination: Chipotle will not unlawfully discriminate against you for exercising your privacy rights under the California Privacy Rights Act.

How to Exercise Your California Privacy Rights

Chipotle will respond to request to know, access, delete, and correct in accordance with applicable law if it can verify the identity of the requestor. You can exercise these rights in the following ways:

How We Will Verify Your Request
The processes that we follow to verify your identity when you make a request to know, access, correct, or delete are described below. The relevant process depends on how and why the request is submitted.

For a general request, such as a request to know how we handle your personal information, we will match at least two information points that you provide against information about you that we already have in our records and that we have determined to be reliable for purposes of verifying your identity.

For an escalated request, such as a request for specific pieces of your personal information, we will match at least three information points that you provide against information that we already have about you in our records and that we have determined to be reliable for purposes of verifying your identity.

We have implemented the following additional procedures when verifying the identity of requestors:

  1. If we cannot verify your identity based on the processes described above, we may ask you for additional verification information. If we do so, we will not use that information for any purpose other than verification.
  2. If we cannot verify your identity to a sufficient level of certainty to respond to your request, we will let you know promptly and explain why we cannot verify your identity.

Note on Deidentified Information
At times, Chipotle converts personal information into deidentified information using reasonable measures to ensure that the deidentified information cannot be associated with the individual (“Deidentified Information”). Chipotle maintains Deidentified Information in a deidentified form and does not attempt to reidentify it, except that Chipotle may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes ensure that the information cannot be associated with the individual. Chipotle prohibits vendors, by contract, from attempting to reidentify Chipotle’s Deidentified Information.

European Economic Area, and the United Kingdom

The information in this section applies to applicants who reside in the European Economic Area (EEA), and the United Kingdom (UK) (collectively, “Europe”). Individuals in Europe are not required by statute or by contract to provide any personal information to the Site.

The data controller of your personal information is the Chipotle corporate group member to which you are applying for employment. You can identify your controller and its contact details via the Chipotle name provided on the application process, or by emailing privacy@chipotle.com.

International Transfer of Your Personal Information
We are headquartered in the United States, but we are a global business with subsidiaries and affiliates, restaurants and personnel located in Canada, the UK, and countries in the EEA. If you are applying for a position with us from outside the U.S., the personal information that we collect about you in the recruitment process will be transferred to, and stored on, our servers located in the U.S. and Canada, and on servers maintained by our recruitment service providers which may result in the international transfer of your data. Authorized employees of Chipotle and/or affiliated entities at locations outside the United States may have access to your personal information as part of the recruitment process. These employees may use and disclose your personal information only for recruitment purposes and must handle that information in accordance with this Privacy Notice and applicable information protection laws and guidance. The information protection laws where these companies are located may be less stringent than the laws of your home country. Contact details of the Chipotle group entities that may access your personal information can be obtained by emailing privacy@chipotle.com.

We have taken steps to ensure an adequate level of protection for your transferred personal information, including through contractual clauses approved by the applicable data protection authority (the “SCCs”) to which Chipotle has entered into with its subsidiaries and affiliates, and service providers described above. You may obtain a copy of any relevant SCCs by submitting a request to privacy@chipotle.com.

Your Additional Rights 
To the extent provided by applicable law and subject to any relevant exceptions, you have the following rights.

  • Access: The right to request access to your personal information maintained by Chipotle.
    • More on the right of access: The right to access your personal information includes the right to receive a copy of all, or a portion, of their personal information in Chipotle’s possession as long as Chipotle’s providing the personal information would not adversely affect the rights and freedoms of others.
  • Rectification: The right to request that Chipotle update or correct your personal information that is outdated or inaccurate.
  • Deletion: The right to request that Chipotle to delete/erase your personal information.
  • Restrict Processing: The right to request restriction of processing of your personal information in certain situations, such as while a dispute concerning the accuracy of personal information is being resolved.
  • Withdraw Consent: The right to withdraw your consent to the processing of your personal information, at any time, where you previously consented to the processing of your personal information.
    • More on the right to withdraw consent: Any withdrawal shall not affect the lawfulness of processing based on your consent before its withdrawal, and Chipotle will continue to retain the personal information that you provided us before you withdrew your consent for as long as allowed or required by applicable law.
  • Data Portability: You have the right to request that Chipotle transfer your personal information to a third party.
    • More on the right to information portability: Subject to certain limitations, the right to information portability allows you to obtain from Chipotle, or to ask Chipotle to send to a third party, a copy of your personal information in electronic form that you provided to Chipotle in connection with your interactions with Chipotle.
  • Objection: You have the right to object to the processing of your personal information.
    • More on the right to object: You have the right to object when processing of your personal information is based solely on Chipotle’s legitimate interests. If you do object in these circumstances, the processing of your personal information will be stopped unless there is an overriding, compelling reason to continue the processing or the processing is necessary to establish, pursue or defend legal claims.
  • Right to Lodge a Complaint: If you believe that your personal information has been processed in violation of applicable information protection law, you have the right to lodge a complaint with the competent supervisory authority in the country where you reside, where you work, or where the alleged violation occurred.
    • Individuals who reside in the European Union can find their competent supervisory authority here.
    • Individuals who reside in the UK can find their competent supervisory authority here.

How To Exercise Your Rights
Chipotle will respond to requests to exercise individual data rights in accordance with applicable law. To request to exercise your data rights, you can contact us as follows:

  • By Email: privacy@chipotle.com
  • By mail in the EEA:
    Chipotle Mexican Grill France SAS
    6 place de la Madeleine
    75008 Paris
    France
  • By mail in the United Kingdom:
    Chipotle Mexican Grill UK Ltd.
    83 Baker Street,
    London,
    W1U 6AG

Changes to This Notice
Chipotle may change this Privacy Notice from time to time in its sole discretion. If we make a material change to this Notice, we will inform you by posting a notice on the Site. Those changes will go into effect on the effective date posted in the revised notice. The new policy will apply to all current and past users of the online application page and to all information collected before the date of the change. The new policy will replace any prior policies that are inconsistent. Please check periodically for changes to this Notice, and especially before you provide any personal information to us. If we will materially change how we use, disclose or otherwise process your personal information, we will contact you before doing so and obtain your consent before using, disclosing or otherwise processing your personal information other than as described in this Notice.

Inquiries and Concerns
Please direct any questions or concerns you may have about this Privacy Notice to privacy@chipotle.com.