PAQ, INC. PRIVACY POLICY

Updated: July 31, 2026

At PAQ, Inc. (Food4Less & Rancho San Miguel Markets), we are committed to providing you the best customer experience possible. This Privacy Policy explains what information we collect, how that information is used, under what circumstances we disclose information, and the choices you can make about that information. This Policy applies to information we collect whether you access our websites and other online services (collectively, the “Services”), shop in our stores, or otherwise interact with us. Through the Services, we may present privacy policies governing certain third parties’ processing of information. We are not responsible for, and this Privacy Policy does not apply to, such third parties’ processing of information.

Information We Collect

1. Information you provide to us or allow others to provide to us

At various points in the PAQ, Inc. (Food4Less & Rancho San Miguel Markets) experience, you may provide us with information about yourself. For example, when you create an account, sign up to receive emails from us, make a purchase, or communicate with us via third-party social media sites, we collect the personal information you provide like your name, email address, delivery address, zip code, phone number, and any other details you choose to share with us. The Services may also offer social sharing features and other integrated tools (such as the Facebook “Like” button) which let you share actions you take on the Services with other media, and vice versa. Your use of such features enables the sharing of information with your friends or the public, depending on the personalized privacy settings you establish with the entity that provides the social sharing feature, which is outside of our direct control. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

2. Information we collect automatically

When you access or use the Services we automatically collect information about you, including:

Information Collected by Cookies, Pixels, and Other Tracking Technologies:

We (and our service providers) use various technologies to collect information, including but not limited to cookies, pixels, scripts, and device identifiers. Cookies are small text files that are sent by your computer when you access the Services through a browser. We and other companies we engage may use session cookies (which expire when you close your browser), persistent cookies(which expire when you choose to clear them from your browser), pixels, scripts, and other identifiers to collect information from your browser or device that helps us do things such as improve the Services and your experience, understand how you use the Services and other services, serve advertisements on third-party sites and apps that are targeted to your interests, and personalize your experience.

Usage Information:

We (and our service providers) collect information about your use of the Services, and these third-parties may also deploy cookies, pixels, or other identifiers on our site. For example, we use Google Analyticsto understand, in an anonymized, non-personal way, how users interact with various portions of our site.

Log Information:

When you use the Services, our servers record information about your usage of the Services and information sent by your browser or device. Logs information can include things like IP address, browser, operating system, and/or app you are using, unique device identifiers, pages you view and links you click, searches you run, and other ways you interact with the Services. If you are logged into the Services, this information is stored with your account information.

Transaction Information:

When you make a purchase, return an item, or redeem an offer from us, we collect information about the transaction, such asproduct details, shipping information, purchase price, date, and location of the transaction.

3. Information we collect from other sources

We may also obtain information about you from other sources. For example, we may collect information about you from third parties that help us provide the Services and process your orders. For example, we currently partner with InstaCart for our online shopping (“E-Commerce”) services. We may also collect information from publicly available sources and combine that information with information we collect about you. Our partners may let us collect information about use of their sites/apps or share such information with us. For example, if you use a PAQ, Inc. (Food4Less & Rancho San Miguel Markets) button or widget on another site or app, we may receive information about your use of that button or widget and the third-party site/app.

Use of Information

We use the information we collect to deliver the products and services you request and customize your experience with us. We may also use the information we collect to:

  • Provide, maintain and improve our products and Services;
  • Charge you for the purchase costs through one or more payment processing partners;
  • Understand how users interact with the Services as a whole and to test new features and products or changes in our features and products, including to generate de-identified data that will not re-identify;
  • Provide customer service, respond to your communications and requests, and contact you about your use of the Services;
  • Communicate with you about products, services, offers, and other information we think may be of interest to you;
  • Monitor and analyze trends, usage, and activities;
  • Personalize your online experience and the content you see when you use the Services or third-party platforms and audit your interactions with content and ads, including, but not limited to, by counting ad impression and unique visitors, verifying positioning and quality of ad impressions;
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
  • Debugging to identify and repair errors that impair existing intended functionality.
Biometric Technologies and Automated License Plate Recognition

Biometric information (including facial recognition, feature recognition, and other image-based or biometric identifier technologies) is considered “Sensitive Personal Information” under California law, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

PAQ uses biometric technologies solely and narrowly for legitimate business purposes related to loss prevention, fraud prevention, workplace safety, and violence prevention, consistent with:

  • The California Constitution, Article I, Section 1 (right to privacy);
  • California Civil Code §1798.100 et seq. (CCPA/CPRA);
  • Applicable California labor and employment laws;
  • PAQ’s Privacy Policy and Records Retention Schedule;
  • Any applicable legal hold obligations.

PAQ retains biometric information and biometric bookmarks only for as long as reasonably necessary and proportionate to achieve the disclosed and lawful business purpose for which the information was collected.

At certain of our locations, PAQ conducts vehicle inventories using automated license plate recognition (ALPR) technology. Using fixed and/or mobile cameras positioned at different sites, PAQ collects and maintains images of vehicle registration plates and the characters they contain, which are converted into computer-readable data (“ALPR Data”).

ALPR Data may be used and processed for the following purposes:

  • To enhance security at Company locations;
  • To identify and track abandoned vehicles;
  • To enforce applicable parking rules; and
  • To respond to inquiries of law enforcement agencies.

PAQ does not process or make the ALPR system or ALPR Data available to individuals for personal, non-commercial purposes, nor is the ALPR system automatically connected to any law enforcement system.

The ALPR system is managed by the Director of Loss Prevention, who is responsible for safeguarding ALPR Data, including its collection, use, security, integrity, dissemination, retention, monitoring, and destruction, as well as ensuring employees operate the ALPR system within the parameters of the law and this Privacy Policy. Only authorized employees in Loss Prevention and IT may access ALPR Data for legitimate purposes related to the ALPR purposes listed above.

Prior to being provided access to ALPR Data, and annually thereafter, employees are required to participate in training on the safeguards PAQ has for protecting this information. PAQ monitors the ALPR system and ALPR Data through security applications and periodic review of log files, and PAQ audits the ALPR system periodically.

ALPR Data sharing or transfer requires, at a minimum:

  • A written request identifying the entity and person requesting ALPR Data and the reason for the request;
  • Review by the Director of Loss Prevention or his/her designee; and
  • Approval or denial of the request, with the determination communicated to the requesting party.

In general, PAQ does not sell or share customer license plate data except as may be provided in this Privacy Policy for personal information.

PAQ retains ALPR Data for one year, at which time it is purged from the ALPR system, unless PAQ is required by law or contract to retain such information. ALPR Data is periodically reviewed to determine whether it needs to be removed from the ALPR system and destroyed.

Violations of PAQ’s ALPR requirements may result in disciplinary action up to and including termination of employment. PAQ reserves the right to revise ALPR requirements at any point in the future, and such changes may apply retroactively to data collected prior to any revision.

Disclosure of Information

PAQ, Inc. (Food4Less & Rancho San Miguel Markets) offers a platform that allows you to order grocery items for pick up in-store or have them delivered to you. To facilitate this, we may disclose information about you as follows or as otherwise described in this Privacy Policy:

  • With vendors, service providers, and consultants that perform services for us, including third parties that help us provide our Services and process your orders as well as those that provide payment processing and delivery services;
  • In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements;
  • If we believe your actions are inconsistent with our user agreements or policies, if we believe you have violated the law, or to protect the rights, property, and safety of PAQ, Inc. (Food4Less & Rancho San Miguel Markets) or others;
  • Between and among PAQ, Inc. (Food4Less & Rancho San Miguel Markets) and our current and future parents, affiliates, subsidiaries, and other companies under common control and ownership; and
  • With your consent or at your direction.

We may also share aggregated or de-identified information that cannot reasonably be used by those third parties to identify you.

Changes to this Policy

This policy may change from time to time and any revised Policy will be posted at this page, so we encourage you to review it regularly. If we make changes, we will notify you by revising the date at the top of this Policy.

Contact Information

PAQ, Inc. (Food4Less & Rancho San Miguel Markets)

3021 Reynolds Ranch Parkway, Suite 230

Lodi, CA 95240

Ph: (209) 957-2555

privacy@paqinc.com

YOUR CALIFORNIA PRIVACY RIGHTS

Consumers residing in California have certain rights with respect to their personal information under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act or (“CPRA”) (California Civil Code Section 1798.100 et seq.). If you are a California resident, this section applies to you.

California Privacy Rights Act (CPRA)

Additional Disclosures Related to the Collection, Use, and Disclosure of Personal Information In the preceding 12 months, we have collected the following categories of personal information: identifiers, commercial information, internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from any of the information provided. We do not use or disclose sensitive personal information to infer characteristics about you. We collect this information from the categories of sources described in “Information we Collect” above. For details about the precise data points we collect and the categories and sources of such collection, please see “Information we Collect” above. We collect personal information for the business and commercial purposes described in “Use of Information” above.

Sensitive Personal Information, including biometric information, is collected and used only for the limited business purposes described in this Privacy Policy. PAQ does not use or disclose Sensitive Personal Information to infer characteristics about you.

Opt Out of Sales and Sharing

As described in “Information Collected by Cookies, Pixels, and Other Tracking Technologies” above, we use personal information to serve you advertisements on non-PAQ, Inc. (Food4Less & Rancho San Miguel Markets) properties. These activities may result in us selling or sharing identifiers, commercial information, and internet or other electronic network activity information with our advertising partners so they can show you advertisements that are targeted to your interests on other platforms. You have the right to opt out by clicking the cookie icon in the lower left hand corner of our website and disabling advertisement cookies.

Your Consumer Rights

If you are a California resident, subject to certain limitations, you have the right to (1) request more information about the categories of personal information we have collected, and disclosed for a business purpose in the last 12 months; (2) request access to the specific pieces of personal information we have collected; (3) request correction of your personal information; (4) request deletion of your personal information; (5) opt out of the sale or sharing of your personal information, as described above; and (6) be free from discrimination for exercising your rights under the CCPA and the CPRA. The easiest way to submit a request is to complete this web form. You can also call (209) 957-2555 for assistance.

We will verify your request by asking you to provide specific information related to your past interactions with us, such as information about a purchase you made or survey you completed. To designate an authorized agent to exercise these rights on your behalf, please have them submit a request via email that includes the information outlined above. You must also provide the authorized agent with power of attorney pursuant to Probate Code section 4000 to 4465 or written and signed permission to submit the request, as well as verify your own identity directly with us, and directly confirm with us that you have provided the authorized agent with permission to submit the request.

Data Retention

We store personal information for as long as necessary to carry out the purposes for which we originally collected it, satisfy our legal requirements, or for other business purposes explained in this Privacy Policy.

Additional retention terms: PAQ retains ALPR Data for one year, unless PAQ is required by law or contract to retain such information. PAQ retains biometric information and biometric bookmarks only for as long as reasonably necessary and proportionate to achieve the disclosed and lawful business purpose for which the information was collected.