WinCo Foods’ Privacy Policy

LAST UPDATED: November 10th, 2023

YOUR PRIVACY: OVERVIEW 

If you are a consumer in the United States, this privacy policy ("Privacy Policy") explains how WinCo Holdings, Inc. and WinCo Foods, LLC (collectively, "WinCo," "we," or "us") collects, uses, discloses, and retains your personal data when you access or use our website, shop in our stores, engage with us on social media, apply for a job or otherwise interact with us. This Privacy Policy also tells you about your privacy rights and how the law protects you and your personal information.  Please review this Privacy Policy carefully.

REVISIONS TO THIS PRIVACY POLICY

WinCo reserves the right to change this Privacy Policy from time to time. If we make changes, we will notify you by posting the new Privacy Policy on this page and updating the date at the top of this Privacy Policy.  You are advised to review this Privacy Policy periodically for any changes.  Changes to this Privacy Policy are effective when they are posted on this page.   If we make material changes to this Privacy Policy, we will provide you with additional notice (such as adding a statement to our websites’ homepages or sending you a notification using the contact information we have on file).

CONTENTS

COLLECTION OF PERSONAL DATA

In this Privacy Policy, "personal data" means any information that identifies, relates to, describes, is reasonably capable of being associated with or reasonably can be used to identify an individual or household and other data that is linked to personal data.  The types of personal data we collect about you depend on your interactions with us and are described in more detail below.

PERSONAL DATA YOU PROVIDE DIRECTLY TO US

We collect personal data directly from you in a variety of ways, including when you:

  • Register for an account or create a profile;
  • Request additional information about our products or services or sign up to receive our e-mail newsletters, marketing messages or coupons;
  • Interact with us on social media, such as by tagging us and/or our products or permitting us to follow your social media profile;
  • Purchase any product or service from us, including gift cards and online orders for in-store pick up;
  • Provide product feedback or make other submissions to us;
  • Request information or assistance from us, including correspondence with our customer service team;
  • Participate in or respond to surveys or requests for opinions, feedback and preferences;
  • Use other features of our websites that may be offered from time to time, which may require information in order to utilize the features;
  • Sign up for and participate in events, contests, sweepstakes, promotions and special programs that we provide; or
  • Apply for employment with us.

The types of personal data we collect directly from you may include: your name, username, password, e-mail address, address, telephone number, credit card and debit card numbers (with expiration dates), demographic information, personal preferences, and any other personal data that you choose to include in your profile or in other communications with us.

PERSONAL DATA WE COLLECT AUTOMATICALLY

We automatically collect personal data when you access and use our website or shop in our stores. The types of information we collect may include:

  • Networking and device information, such as your browser type, IP address, and operating system version, language settings;
  • Information about your activity on our website, such your access times, pages viewed, the routes by which you access our website, your use of any hyperlinks available within our website;
  • Information about your purchases or transactions with us, including records of products or services you have purchased, returned, exchanged, or are considering purchasing from us;
  • Information collected via cookies, web beacons, and other tracking technologies, including Internet Service Provider (ISP), Mobile Advertising ID, media access control (MAC) address, or identifiers associated with browser cookies, web beacons and similar technologies we deploy on our Services;
  • Video monitoring and recording we deploy in our retail stores;
  • Information collected in connection with applying for employment with us; and
  • Location information in accordance with your device permissions. For more details, please see “YOUR CHOICES” below.

PERSONAL DATA WE COLLECT FROM OTHER SOURCES

We may collect personal data about you from other sources.  For example, we may collect personal data about you from:

  • Third-party social media and communication services, such as Facebook, Twitter, Google and Instagram, that you use to interact with our website (e.g., to create an account) or that allow you to share information (e.g., via plugins, widgets or other tools), but always in accordance with the authorization procedures and privacy settings you establish with such services; and
  • Unaffiliated parties, such as service providers that we use, analytics companies, advertising networks, consumer data resellers, and other third parties that provide us with information, so we can better understand you and provide you with information and offers that may be of interest to you.

PERSONAL DATA WE DERIVE

We may derive information or draw inferences about you based on the other types of personal data we collect. For example, we may infer your location based on your IP address and suggest the nearest store or that you are interested in purchasing a deli tray based on your browsing behavior.

USE OF PERSONAL DATA

We collect and use personal data for business and commercial purposes, including to:

  • Develop, provide and improve our products, events and services;
  • Complete the transactions you request, perform our contractual obligations, and as otherwise anticipated within the context of our ongoing business relationship;
  • Create and manage your online accounts and profiles;
  • Send notifications related to your account, online orders and purchases of gift cards;
  • Respond to your requests and any other communications from you, including to provide customer service;
  • Send advertising or marketing communications about products, services, offers, promotions, rewards and events offered by WinCo and others, and provide news and information that we believe may be of interest to you;
  • Offer and administer events, contests, prize draws, sweepstakes and other promotions;
  • Conduct internal research and development;
  • Analyze your engagement with our brand and your use of our website to better understand your interests and behaviors and customize your experience;
  • Detect security incidents and protect against malicious, deceptive, or illegal activity, including fraudulent transactions, error, negligence, and breach of contract, and to protect against harm to the rights, property or safety of WinCo and our users, customers, employees or the public;
  • Debug, identify and repair errors that impair existing intended functionality of our website;
  • Comply with our legal obligations, including our tax obligations and those related to the prevention of fraud and money laundering, and those required for you to benefit from rights recognized by law, or any regulatory requirements or provisions;
  • Carry out certain short-term activities and other reasonable internal purposes related to the products or services you purchase from us or your ongoing relationship with us; and
  • Evaluate or conduct any merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of WinCo’s assets, as well as any acquisition, disposal, securitization or financing relating to WinCo.

DISCLOSURE OF PERSONAL DATA

We share personal data for the purposes described below:

  1. With our Affiliates and Subsidiaries. Disclosures of your personal data to our holding company, subsidiaries and affiliates take place for the purposes described in the “USE OF YOUR PERSONAL DATA” section above. In such cases, our affiliates and subsidiaries will operate pursuant to and will honor this Privacy Policy.
  2. With our Service Providers and Contractors.  We share personal data with unaffiliated companies or individuals we hire or work with that perform services on our behalf, including customer support, web hosting, information technology, payment processing, fraud control, direct mail and email distribution, events, contest, sweepstakes and promotion administration, and analytics services.  We only share with service providers and contractors the personal data that they need to perform services for us. Since our service providers and contractors are located around the world, please note that these disclosures may involve cross-border transfers of your personal data as described in the “DATA TRANSFERS” section below.

We may provide paid products and/or services via our website. In that case, we may use third-party services for payment processing (e.g. payment processors). We will not store or collect your payment card details. That information is provided directly to the payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

  1. In Connection with a Corporate Transaction.Personal data may be disclosed or transferred as part of, or during negotiations of any purchase, sale, lease, merger, amalgamation or any other type of acquisition, disposal, securitization or financing involving WinCo.
  2. With our Professional Advisors.We share personal data with our legal, financial, insurance and other advisors in connection with the kinds of corporate transactions described above or in connection with the management of all or part of WinCo’s business or operations.
  3. With Law Enforcement Authorities and Individuals Involved in Legal Proceedings. We disclose personal data when we believe doing so is reasonably necessary to comply with applicable law or legal process (including an enforceable request from authorities), to respond to claims (including inquiries by you in connection with your purchases from WinCo), or to protect the rights, property or personal safety of WinCo, our users, employees or the public.
  4. With Your Consent or at Your Direction. We share personal data with third parties when we have your consent to do so. For example, if you decide to participate in certain interactive areas or features of our events or our website, such as creating a public profile and creating a shopping list, you consent to the disclosure of this information to other users of our websites. We may also share your personal data with third parties when you intentionally direct us to do so or when you use our website to intentionally interact with third parties.

We may also share aggregated or de-identified information, which cannot reasonably be used to identify you.  

ADVERTISING AND ANALYTICS SERVICES PROVIDED BY OTHERS

We may allow others to provide analytics services and serve advertisements on our behalf across the web and in mobile applications. These entities may use cookies, web beacons, device identifiers, and other tracking technologies which collect information about your use of the Services and other websites and applications. This information may be used by WinCo and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interest on our website and other websites, and better understand your online activity. For detailed information on the cookies we use and the purpose for which we use them, see the section about Cookies below.

DATA SECURITY, TRANSFERS, AND RETENTION

DATA SECURITY

The transmission of information via the internet is not completely secure or private. If you have any questions about the security of personal data collected by WinCo, please contact: [email protected].

DATA TRANSFERS

For the reasons and purposes set forth in this Privacy Policy, the personal data that we collect may be transferred to and stored or otherwise processed in the United States and other locations. We also transfer personal data to service providers that process personal data for us in the United States, and other locations (as an example, Amazon Web Services process information for us in various data center locations, including those listed at HTTPS://AWS.AMAZON.COM/ABOUT-AWS/GLOBAL-INFRASTRUCTURE/). While in another jurisdiction for processing, your personal data may be accessed by the courts, law enforcement, and national security authorities of that jurisdiction. These jurisdictions may not provide the same level of data protection as your home jurisdiction.  Your consent to this Privacy Policy and submission of your personal data constitutes your agreement to any such transfer.

RETENTION OF PERSONAL DATA

We retain personal data in accordance with applicable law and only as long as is necessary for the purposes set out in this Privacy Policy and by the schedule in the WinCo Record Retention Policy.  Unless otherwise required by applicable law, to comply with our legal obligations, resolve disputes or enforce our legal agreements and policies, WinCo will take reasonable steps to destroy or permanently de-identify personal data it holds if such personal data is no longer needed for the purpose for which it was collected.

CHILDREN’S PRIVACY

Our website and our services are not intended for children under the age of eighteen (18). WinCo does not target its products to children under eighteen (18) years old.  We do not knowingly collect personally identifiable information for anyone under the age of eighteen (18).  If you are a parent or guardian and you are aware that your child under the age of 18 has provided WinCo with personal data, please contact us.  If we become aware that we have collected personal data from anyone under the age of 18 without verification of parental consent, we take steps to remove that information from our servers.

THIRD PARTY SITES

Please note that our websites contain links to third-party websites that are not controlled or operated by WinCo.  If you follow a link to any of these websites, please note that these websites have their own privacy policies and that WinCo does not accept any responsibility or liability for these policies.  Please review these policies before you disclose any personal data when visiting such third-party websites.

YOUR CHOICES

You have certain choices with respect to how we treat your personal data, as described below.

CORRECTION

You may review and modify your account and profile information by logging into your online account at any time. You may also contact us (below) and request that we update your account or profile information if you are unable to access your online account.

MARKETING COMMUNICATIONS

You may opt out of receiving promotional communications from us by following the instructions in those communications or by logging into your online account and changing your communications preferences. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business relations.

LOCATION DATA

When you first launch our website, it collects precise location information through your computer’s or mobile device’s IP address (automatically) or device location (upon granting our website access).  You can subsequently stop the collection of this information at any time by changing the website preferences on your device.  If you do so, our website, or certain features thereof, may no longer function properly.

COOKIE policy

Like many websites, WinCo  collects certain information by automated means when you visit the Winco website, such as how many users visit the website and other related analytics. We collect this information to learn how to improve the website and how to best tailor it to our visitors. When you visit the website, we may automatically collect some information about your visit using cookies, log analytics software, and other aggregate tracking technologies.

Cookies are bits of text that are placed on your computer’s hard drive when you visit certain websites. We may use cookies to tell us, for example, whether you have visited us before. If you wish, you may decline cookies or set your browser to refuse cookies. Most browsers will tell you how to stop accepting new cookies, how to be notified when you receive a new cookie, and how to disable existing cookies.

First-party cookies: On the WinCo website we use certain WinCo cookies. Refusal of these cookies may result in your inability to access some pages or use some of the features and functions of our website. If you accept but then decline cookies, please note that some WinCo cookies will remain on your computer’s hard drives unless and until you manually delete the cookie file. However please note that if you do this you may not be able to use the full functionality of this website. WinCo cookie files generally do not contain personal information or track your movement outside of our site.

Analytics: WinCo’s website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to help WinCo analyze how users use the website. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity, and providing other services relating to website activity and internet usage for us. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

Social media: We may use social media sharing and other “widgets” to enable interaction with social networks, such as Facebook, Twitter, Pinterest, Youtube, Instagram and LinkedIn. Some of these social networks may be able to track your visit to the website (or any site that uses the widgets) because when you visit a social network, it may place personally identifiable cookies in your browser that are then transmitted back to the social network when you visit other sites that use that network’s widgets, even if you do not click on or interact with the widget. If you have questions about a particular social network’s information collection or cookie practices, please refer to the privacy and use policies of that social network.

Functionality: These cookies allow the website to remember choices you make (such as your user name, language, or the region you are in) and provide enhanced features. For instance, the website may be able to remember your login details, so that you do not have to repeatedly sign in to your account when using a particular device to access the website. These cookies can also be used to remember changes you have made to text size, font, and other parts of web pages that you can customize. The information these cookies collect is usually anonymized. They do not gather any information about you that could be used for advertising or remember where you have been on the internet.

The major browsers have attempted to implement the draft “Do Not Track” (“DNT”) standard of the World Wide Web Consortium (“W3C”) in their latest releases. As this standard has not been finalized, WinCo’s website is not compatible with DNT and so, does not recognize DNT settings.  

INFORMATION FOR CALIFORNIA CONSUMERS: YOUR CALIFORNIA PRIVACY RIGHTS

ADDITIONAL DISCLOSURES RELATED TO COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

If you are a California resident, the California Consumer Privacy Act (“CCPA”) requires us to disclose the following information with respect to our collection, use and disclosure of personal data.

  • Categories of Personal Information Collected: We collect the following categories of Personal Information:
    • Identifiers: This may include name, address, unique personal identifier, online identifier, browser type, IP address, operating system version, language settings, email address, account name, driver’s license numbers as applicable, or other similar identifiers
    • Characteristics of protected classifications under California or U.S. law:  This may include age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)
    • Commercial information:  This may include information about your purchases or transactions with us, including records of products or services you have purchased, returned or are considering purchasing from us.
    • Internet and electronic network activity:  This may include your interaction with our website, such your access times, pages viewed, the routes by which you access our website, your use of any hyperlinks available within our website.  This may also include information collected via cookies, web beacons, and other tracking technologies, including Internet service provider (ISP), Mobile Advertising ID, media access control (MAC) address, or identifiers associated with browser cookies, web beacons and similar technologies.
    • Geolocation data:  This may include your approximate physical location.
    • Audio and visual information:  This may include video monitoring and recording we deploy in our retail stores
    • Inferences drawn about your preferences, and other categories of personal data that relates to or is reasonably capable of being associated with you.

Under the CCPA, Personal Information does not include: publicly available information from government records; deidentified or aggregated consumer information; and information excluded from the CCPA's scope.

  • Business or Commercial Purpose for Collecting and Using Data: We collect Personal Information for the business purposes described in the “USE OF YOUR PERSONAL DATA” section above.
  • Categories of Sources of Personal Data: We collect Personal Information from you and the sources described in the “PERSONAL DATA WE COLLECT FROM OTHER SOURCES” section above.
  • Categories of Personal Data Disclosed: In the preceding twelve (12) months, we have disclosed the following categories of Personal Information for business or commercial purposes: identifiers, internet and electronic network activity information, commercial information, audio and visual information, geolocation data, demographic information, inferred information, and other information that we have derived or inferred about you or that relates to or is reasonably capable of being associated with you.
  • Categories of Third Parties With Whom We Share Personal Data: We may share your Personal Information  with the third parties as described in the “DISCLOSURE OF PERSONAL DATA” section above.  We may share Your Personal Information identified in the above categories with the following categories of third parties:
  • Service Providers and Contractors
  • Payment processors
  • Our affiliates
  • Our business partners
  • Third party vendors to whom you or your agents authorize WinCo to disclose your personal information in connection with products or services we provide to you
  • Sale of Personal Information: WinCo does not sell your Personal Information.

YOUR CONSUMER RIGHTS

California consumers have the right to request access to their Personal Information, additional details about our information practices and deletion of their Personal Information (subject to certain exceptions). California consumers also have the right to opt out of sales of Personal Information, if applicable. We describe how California consumers can exercise their rights under the CCPA below. Please note that you may designate an authorized agent to exercise these rights on your behalf by providing written materials demonstrating that you have given the authorized agent signed permission to submit the request. Please note that if an authorized agent submits a request on your behalf, we may need to contact you to verify your identity and protect the security of your Personal Information. We will not discriminate against you if you choose to exercise your rights under the CCPA.

Right to Access. You have the right to access Personal Information which we may collect or retain about you. If requested, we shall provide you with a copy of your Personal Information which we collect as permitted by the CCPA. You also have the right to receive your Personal Information in a structured and commonly used format so that it can be transferred to another entity (“data portability”).

Right to Know. You have the right to request that we disclose the following about your Personal Information, as defined by the CCPA:

  1. The specific Personal Information we may collect;
  2. The categories of Personal Information we may collect;
  3. The categories of sources from which we may collect your Personal Information;
  4. The business purpose(s) for collecting or sharing your Personal Information;
  5. The categories of Personal Information we may disclose for business purposes; and
  6. The categories of third parties to whom we may share your Personal Information.

Right to Opt-Out/Not Sell My Personal Information. WinCo does not sell or share Personal Information within the meaning of the CCPA.

Right to Limit Sensitive Personal Information. WinCo does not collect or processes Sensitive Personal Information for the purpose of inferring characteristics about its consumers.

Right to Deletion. In certain circumstances, you have the right to request the erasure of your Personal Information. Upon verifying the validity of a deletion request, we will delete your Personal Information from our records, and instruct any service providers or contractors to delete your information, when applicable.

Right to Correction/Rectification. In certain circumstances, you have the right to request correction of any inaccurate Personal Information. Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your Personal Information as directed, taking into account the nature of the Personal Information and the purposes of maintaining your Personal Information.

Exercising Your Rights.  If you are a California resident, you can exercise any of your rights as described in this Privacy Policy and under applicable privacy laws by using the contact information provided in herein. We will not discriminate against you for exercising such rights. Except as described in this notice or provided for under applicable privacy laws, there is no charge to exercise of your legal rights.  However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either (i) charge a reasonable fee taking in account the administrative costs of providing the information or taking the action requested; or  (ii) refuse to act on the request and notify you of the reason for refusing the request.

In order to exercise any of your rights under the CCPA, and if you are a California resident, you may contacts us by calling 1-800-824-1706, emailing [email protected] or visiting wincofoods.com/contact.

After submitting your request, please monitor your email for a verification email. We are required by law to verify your identity prior to granting access to your data in order to protect your privacy and security. Your request to us must provide sufficient information that allows us to reasonably verify you are the person about whom WinCo collected personal information or an authorized representative, and describe your request with sufficient detail that allows WinCo to properly understand, evaluate, and respond to it.

We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.

Other California Privacy Rights: California’s “Shine the Light” law (California Civil Code section 1798.83) gives customers who are California residents the right to ask, once a year, (1) what personal information was disclosed to third parties for those third parties’ direct marketing purposes in the prior calendar year; and (2) the identities of the companies with whom the information was shared. The terms “customers” and “personal information” have the meaning given by the Shine the Light (California Civil Code Sec 1798.83).  

We do not share personal information, as defined in California Code Civil Section 1798.83, with third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with California’s Shine the Light law by sending us a written request to [email protected] or by mailing us a letter to: WinCo Foods, LLC, 650 N. Armstrong Place, Boise, ID 83704, (Attention: Digital Marketing). Any such written request must include “California Shine the Light Law Request” in the first line of the description and include your name, street address, city, state, and zip code. We are only required to respond to one Shine the Light law request per customer per year, and we are not required to respond to requests made by means other than through this email address and mailing address. Further note that “Shine the Light” rights and CCPA rights are provided under different statutes and must be exercised separately.  

Other State Specific Privacy Laws This Privacy Policy also applies to consumers who reside in states that have adopted consumer privacy laws. Because of differences in certain state laws and the effective dates of those state laws, this section may apply to residents of one or more states with consumer privacy laws requiring such information. States that have passed consumer privacy laws as of the date of this Privacy Policy and Notice are Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia (collectively “US State Privacy Laws”).   We have not sold personal information in the past twelve months. We have also not “shared” or made available personal information for the purposes of targeted advertising in the past twelve months.  

Your Rights Under Applicable US State Privacy Laws. To the extent applicable under US State Privacy Laws, you may have the following rights in connection with your personal information:

  • You have a right to confirm whether or not we process your personal information as well as to access and receive a copy of the specific personal information we have collected about you.
  • You have a right to receive the Personal Information, limited to the Personal Information you previously provided to us, in a structured and commonly used format so that it can be transferred to another entity (“data portability”).
  • You have a right to deletion of your personal information, subject to exceptions under applicable US State Privacy Laws.
  • You have a right to request correction of any inaccurate personal information we hold about you.
  • You have a right to opt-out of our sale or our use of personal information for targeted advertising purposes.
  • Finally, you have a right to receive notice of our practices at or before collection of personal information and you have a right not to receive discriminatory treatment for exercising any of your rights described under this section. We will not discriminate against you based on your exercise of any of your rights.

  You can assert these rights only where we receive a verified request from you. For information on how to exercise your rights, please see the “Exercising Your Rights” section above.  

Use of Agents. If you are a consumer in a jurisdiction that recognizes the ability to use an authorized agent and wish to contact us through an authorized agent, the authorized agent can submit a request on your behalf to [email protected] or visiting wincofoods.com/contact along with a statement, certified as may be required, that the agent is authorized to act on your behalf. In order to verify the request, we may ask you to verify your identity.  

Appeals. If you are in a jurisdiction that recognizes your ability to appeal a decision we have made in connection with your attempt to assert a right under applicable US State Privacy Laws (such as Texas, Oregon, Montana, Colorado, Connecticut or Virginia), you may file an appeal of our decision refusing  your request to exercise your rights under this Privacy Notice. Requests to change our policies or practices are not grounds for appeal.  You may request an appeal of such decision by contacting us at [email protected] please provide the state that you are writing from, accompanied with documentation you may have regarding the matter you are appealing. If your jurisdiction allows you to file a complaint with the state’s Attorney General’s Office regarding any concerns with the result of your appeal request, you may do so by using the following links as may be applicable to you.

CONTACT US

If you have any questions or comments about this Privacy Policy, you may email us at [email protected] or write to us at: Digital Marketing WinCo Foods, LLC 650 No. Armstrong Place Boise, ID 83704