GDPR & Your Data Rights

01Data Controller

The operator of Panera Bread Menu is the data controller for personal data processed through this website. Panera Bread Menu is an independent, unofficial guide and is not affiliated with Panera Bread; Panera Bread is not responsible for how we process data, and we are not responsible for how Panera processes data when you use its own services.

For any data protection question or request, contact us at contact@panera-breadmenue.com.

02Personal Data We Process

We have no user accounts and do not ask you to fill in forms, so the personal data we process is limited to:

• Technical data: IP address, browser and device information, pages visited, referring URL and timestamps recorded in server logs.
• Online identifiers: cookie IDs and similar identifiers set by us, Google and Google's advertising partners.
• Consent data: a record of the choices you make in Google's consent management message.
• Correspondence: your email address and message if you contact us.

03Purposes and Legal Bases

Under Article 6 GDPR, we rely on the following legal bases:

• Legitimate interests (Art. 6(1)(f)): running and securing the site, preventing fraud and abuse, keeping server logs, and replying to emails and correction requests.
• Consent (Art. 6(1)(a)): setting non-essential cookies, including analytics cookies and cookies used by Google for personalised advertising and ad measurement.
• Legal obligation (Art. 6(1)(c)): keeping records or responding to lawful requests from authorities where required.

Where we rely on legitimate interests, we have balanced our interests against your rights and keep processing minimal. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

04Consent and How to Withdraw It

We do not use a custom cookie banner. Where consent is required, including for visitors from the EEA, the UK and Switzerland, it is requested through Google's certified consent management message before personalised advertising and related cookies are used. You can consent or decline, and declining does not stop you from using the site.

You can withdraw or change your consent at any time by clearing your cookies, adjusting your browser settings to block or delete cookies, or turning off ad personalisation in Google Ads Settings. Withdrawal does not affect the lawfulness of processing before withdrawal. See our Cookie Policy for details of each cookie category.

05Google as an Advertising Partner

We use Google AdSense to display ads. Google and its certified ad partners may process personal data such as cookie identifiers, IP addresses and browsing activity to serve, personalise and measure ads, in line with your consent choices. Google acts as an independent controller for some of this processing. To learn more, see how Google uses information from sites or apps that use its services.

You can also manage ad personalisation at Google Ads Settings and www.aboutads.info/choices.

06International Data Transfers

Some of our service providers, including Google and our hosting provider, may process personal data in countries outside the EEA and UK, such as the United States. When this happens, we rely on recognised safeguards, including:

• The European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.
• Certification under the EU-U.S. Data Privacy Framework (DPF), together with the UK Extension and Swiss-U.S. DPF, where the provider is certified.
• Adequacy decisions for countries recognised as offering an equivalent level of protection.

07How Long We Keep Data

We retain personal data only as long as needed for the purposes described:

• Server logs: up to 90 days, unless needed for a security investigation.
• Consent records: up to 12–13 months, after which we ask again.
• Email correspondence: up to 24 months, or longer only if required to handle a legal claim.
• Third-party cookies: according to the provider's own retention periods, typically up to 13 months for Google advertising cookies.

08Your Rights Under the GDPR

Subject to legal conditions and exceptions, you have the right to:

• Access – obtain confirmation of whether we process your data and a copy of it.
• Rectification – have inaccurate or incomplete data corrected.
• Erasure – ask us to delete your data (“right to be forgotten”).
• Restriction – ask us to limit how we use your data.
• Data portability – receive data you provided in a structured, machine-readable format.
• Objection – object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent – at any time, without affecting earlier lawful processing.
• Not be subject to solely automated decisions with legal or similarly significant effects.

09How to Exercise Your Rights

Email contact@panera-breadmenue.com with the subject line “GDPR request”, tell us which right you wish to exercise and include information that helps us find relevant data, such as the email address you used to contact us. Because we do not have accounts, we often cannot link cookie data to a named person; in that case, clearing your cookies and using Google Ads Settings is the quickest way to control that data.

We will respond within one month of receiving your request. This may be extended by up to two further months for complex requests, in which case we will tell you why. Requests are free unless they are manifestly unfounded or excessive. We may ask for reasonable information to verify your identity.

10Complaints to a Supervisory Authority

If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA member state where you live, work or where the alleged infringement occurred. A list of EU authorities is available from the European Data Protection Board.

11UK GDPR and California (CCPA/CPRA) Notice

United Kingdom: if you are in the UK, your data is protected by the UK GDPR and the Data Protection Act 2018, which give you the same rights described above. You may complain to the Information Commissioner's Office (ICO).

California: under the CCPA as amended by the CPRA, California residents may request to know, access, correct and delete personal information, and opt out of the sale or sharing of personal information for cross-context behavioural advertising. In the past 12 months, we have collected identifiers and internet activity information for the purposes described above. We do not sell personal information for money, but advertising cookies may count as “sharing”; you can opt out using Google Ads Settings, by clearing your cookies, by enabling Global Privacy Control, or by emailing contact@panera-breadmenue.com. We do not knowingly sell or share data of consumers under 16 and will not discriminate against you for exercising your rights. See our full Privacy Policy.