Last Updated: March 27, 2025

INTRODUCTION

1.1 Purpose of Policy

We care about your privacy online, so here is relevant information regarding privacy on our Website, https://bombatacos.com (the “Website”) as owned and operated by GuestCounts Hospitality, LLC (“we”; “us”; or “our”). Our goal is to safeguard the privacy of all our visitors and users; to explain who we are and how and why we collect, store, use, and share personal information; and to explain your rights in relation to your personal information. By using this Website, you agree to the following Privacy Policy. Please read this policy carefully before using this Website. This Policy is only applicable to the Website, and not to any other web sites that you may be able to access from the Website, each of which may have data collection and use practices and policies that differ materially from this Policy.

1.2 No Use for Children

Our Website and any offerings or services on it are not intended for anyone under 13 years of age or anyone considered a child under their country’s laws. If you are under 13, you may not use or provide any information on this Website, use any of its features, register for an account, make any purchases, use any of the interactive or public comment/community features, or provide any information about yourself to us.

If we learn that we have received personal information from a child without validated parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at info@bombatacos.com.

2. INFORMATION COLLECTION PRACTICES

2.1 Information that We Collect and Use

We collect a variety of information from you when you visit our Website, make purchases, or interact with us on social media or with advertising partners. By accepting this Privacy Policy, you specifically consent to our collection of the data described below, to our use of the data, to the processing of this data, and to our sharing of the data with third-party processors as needed for our legitimate business interests.

The information we collect may include:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	NO
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I. Professional or employment-related information.	Current or past job history or performance evaluations.	NO
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO
L. Social Networking Data	We may access personal information from social networking sites and apps, including but not limited to: Facebook, Instagram, LinkedIn, Twitter, Pinterest, TikTok, or other social networking sites or apps not named specifically here, which may include your name, your social network username, location, email address, age, gender, profile picture, and any other public information linked to those accounts. If you do not want us to access this information, please go to the specific social networking site and change your relevant privacy settings.	YES

In operating this Website, we currently disclose your Personal Information to third parties for business purposes. In particular, we have disclosed the following categories of Personal Information of consumers, for a business purpose, within the last twelve (12) months:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	NO
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	YES
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I. Professional or employment-related information.	Current or past job history or performance evaluations.	NO
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES

Personal information does not include:

Publicly available information from government records.

De-identified or aggregated consumer information.

Information excluded from the CCPA's scope, like:

health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and

personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

2.2 Cookies and Similar Technologies

Like many websites, this Website uses cookies, pixels, and similar technologies to track particular aspects of you and other people who visit us. Cookies are tiny files that are downloaded to your computer to track particular aspects of your activity online to help us learn certain things about our Website. This tracking is done to provide us with information on how people move about the site, what is of interest to them and what is not, how our marketing is performing, and incidental items such as what percentage of users access the site from a personal computer versus a mobile phone. You may block most cookies by adjusting your browser settings as well as responding to cookie-consent notices that may appear when you visit this site. This site uses the following cookies:

Google Analytics – _ga_MQJ1TWG504 – More Information
YouTube VISITOR_INFO1_LIVE – More Information
Google Adsense_gcl_au – More Information
Meta – _fbp – More Information
LinkedIn – bscookie – More Information
Doubleclick – IDE – More Information
TikTok – _ttp – More Information

2.3 How We Use Your Information

Your personal information allows us to offer you certain products and services, including the use of our Website; to fulfill our obligations to you; to customize your interaction with our company and our Website; and to allow us to suggest other products and services we think might interest you. We generally store your data and transmit it to a third party for processing. However, to the extent we process your data, we do so to serve our legitimate business interests (such as providing you with the opportunity to purchase our goods or services and interact with our Website).

Specifically, we may use the information and data described above to:

Create and administer your account
Deliver any products or services purchased by you to you
Correspond with you
Process payments or refunds
Contact you about new offerings that we think you will be interested in
Interact with you via social media
Send you a newsletter or other updates about our company or Website
Deliver targeted advertising
Request feedback from you
Notify you of updates to our product and service offerings
Resolve disputes and troubleshoot any problems
Administer contests or giveaways
Generate a profile that is personalized to you, so that future interactions with our Website will be more personal
Compile anonymous statistical data for our own use or for a third party’s use
Assist law enforcement as necessary
Prevent fraudulent activity on our Website or mobile app
Analyze trends to improve our Website and offerings

3. SECURITY

The Website has security measures in place to prevent the loss, misuse, and alteration of the information that we obtain from you, but we make no assurances about our ability to prevent any such loss, misuse, to you or to any third party arising out of any such loss, misuse, or alteration.

4. EEA/GDPR Users

This website is operated in the United States and the third parties with whom we might share your personal information as explained above are also located in the United States or other countries located outside the EU. If you are located in the EEA or elsewhere outside of the United States, please be aware that any information you provide will be transferred to the United States. By using this website, participating in any of its services and/or providing your information, you consent to this transfer.

These countries do not have the same data protection laws as the United Kingdom and EEA. While the European Commission has not given a formal decision that such countries provide an adequate level of data protection similar to those which apply in the United Kingdom and EEA, any transfer of your personal information will be subject to the derogation in Article 49 permitting non-repetitive transfers that concern only a limited number of data subjects, as permitted by Article 49 of the General Data Protection Regulation that is designed to help safeguard your privacy rights and give you remedies in the unlikely event of a misuse of your personal information.

If you would like further information, see “How to Contact Us” below or email us at info@bombatacos.com. We will not otherwise transfer your personal data outside of the EEA or to any organization (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.

If you are covered by the General Data Protection Regulation, you have a number of rights, including the rights to:

Fair processing of information and transparency over how we use your personal information.
Access to your personal information and to certain other supplementary information that this Privacy Policy is already designed to address.
Correcting any mistakes in your information which we hold.
Erasure of personal information concerning you in certain situations.
Receiving the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to a third party in certain situations.
Objecting at any time to processing personal information concerning you for direct marketing.
Objecting to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.
Objecting in certain other situations to our continued processing of your personal information and restricting our processing of your personal information in certain circumstances.

You may also have the right to claim compensation for damages caused by our breach of any data protection laws.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation, available at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.

If you would like to exercise any of those rights, please:

Email, call, or write to us.
Provide us enough information to identify you (e.g., name, e-mail address, mailing address, username, billing details).
Provide us proof of your identity and address (a copy of your driver’s license or passport and a recent utility or credit card bill).
Provide us with the information to which your request relates, including any account, order or reference numbers, if you have them.

5. SITE AREAS BEYOND OUR CONTROL

5.1. Public Forums

The Website may include interactive forums for the exchange of information, ideas and opinions. Please remember that any information that is disclosed in these areas becomes public information and you should exercise caution when deciding to disclose personal information.

5.2. Third Party Websites

The Website may contain links to other websites. If you choose to visit other websites, we are not responsible for the privacy practices or content of those other websites, and it is your responsibility to review the privacy policies at those websites to confirm that you understand and agree with their policies.

6. CONSUMER’S RIGHTS UNDER THE CALIFORNIA CONSUMER PRIVACY ACT (“CCPA”)

6.1California Users’ Rights Under the CCPA

The California Consumer Privacy Act of 2018 (“CCPA”) took effect January 1, 2020, and provides California consumers with certain rights regarding their personal information.

The section above “Information We Collect and Use” explains the specific details of personal information that we collect. The CCPA also requires listing categories of personal information collected. As defined by the CCPA, we collect, or have collected in the past 12 months, the following categories of personal information:

Identifiers (such as name, email address, postal address, phone number, IP address)
Personal information categories listed in the California Customer Records statute [Cal. Civ. Code § 1798.80(e)] such as name, contact information, employment
Commercial information (such as transaction information, purchase history, payment information)
Internet or other electronic network activity information (such as browsing history, search history, online behavior)

Personal information, as defined by the CCPA, does not include publicly available information from government records and de-identified or aggregated consumer information.

We use and disclose the categories of personal information we collect from and about you consistent with the business purposes discussed in the section “How We Use the Information.”

The CCPA also sets forth obligations for businesses that “sell” personal information to third parties. We do not “sell” personal information and have not sold any personal information in the past 12 months. However, we recognize that exchanging your information to other providers for something of value may be considered “selling” under the CCPA’s definition and want to err on the side of transparency.

If you are a California resident, you may have the following consumer rights under the CCPA:

Right to know about personal information collected, used, disclosed, or sold. You have the right to request that we disclose to you the categories of personal information we collect or disclose (or have collected or disclosed in the past 12 months) about you, the categories of sources of such information, the business or commercial purpose for collecting your personal information, and the categories of third parties with whom we share/disclose personal information. This information is also explained throughout this Privacy Policy.
Right to request deletion of personal information. You have the right to request the deletion of your personal information we have collected from you, subject to certain conditions and limitations under the law.
Right to Opt-Out of the sale of personal information. The CCPA provides consumers with the right to opt out of the sale of their personal information. We do not share, sell, rent, or trade User Personal Information with third parties for their commercial purposes as defined under the CCPA.
Right to non-discrimination for exercising a consumer privacy right. We will not discriminate against you for exercising any of your rights under the CCPA.

To exercise any of your rights as set out above, please contact us at info@bombatacos.com. You will be required to verify your identity before we are able to fulfill your request. You can designate an authorized agent to make a request on your behalf. To do so, you will need to provide a written authorization or power of attorney signed by you for the agent to act on your behalf. You will still need to verify your identity with us. Note that consumers may only make a personal information request twice in a 12-month period under the CCPA. We will work to respond to your verifiable request within 45 days of receipt. Certain information may be exempt from requests under applicable law.

7. ADDITIONAL US DISCLOSURES

In addition to the rights described in section 6, residents of certain states (including Colorado, Connecticut, Nevada, Utah and Virginia) may have additional rights under applicable privacy laws, subject to certain limitations, as set forth below.

7.1 Nevada Users’ Rights

Residents of the State of Nevada have the right to opt out of the sale of certain pieces of their personal information to third parties who will sell or license their information to others. If you are a Nevada resident and would like to make such a request, please contact info@bombatacos.com with your request.

7.2 Right to Non-Discrimination. Businesses may not discriminate against residents who exercise their rights under applicable privacy laws. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices or rates or impose penalties on residents who exercise their privacy rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.

7.3 Right to Opt-out. Residents of certain states have the right to opt-out of our “Sale” of their personal information, which may broadly include our selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating (collectively a “Sale”) residents’ personal information to another business or third party for monetary or other valuable consideration. Please note that while some of our sharing of personal information may be a “Sale” as defined by applicable law, we do not sell personal information for monetary compensation. Subject to applicable law, residents may exercise their right to opt-out of the Sale of their personal information by contacting us at info@bombatacos.com.

8. CONTACT INFORMATION AND POLICY UPDATES

8.1 Privacy Concerns, Contacting Us, Complaints

You can contact info@bombatacos.com with any questions or requests about these policies or your personal data.

8.2 Privacy Policy Modifications and Updates

We may update and modify this Privacy Policy at any time. We will email you if we update this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. Your use of the Website and/or its services serves as your acceptance of these updated terms.

9. MISCELLEANOUS

9.1 Severability

If any part of this Privacy Policy is deemed unlawful and/or unenforceable, all other provisions contained herein will remain in full force and effect.

9.2 Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with United States law. Any dispute arising out of or related to the information contained herein is subject to adjudication in the state of Pennsylvania.

How to Contact Us

If you have any questions about this Privacy Policy, please contact us at info@bombatacos.com.

Last Updated: March 27, 2025