PRIVACY POLICY

Last Updated in July 2026

This website collects a limited amount of personal information from its users. This document includes a dedicated section for California consumers and their rights under the CCPA and CPRA. This document can be printed using your browser's print function.

OWNER & DATA CONTROLLER

The Bagel Mill, 212 Western Avenue, Petaluma, California, 94952. Owner contact email: info@thebagelmill.com. Phone: (707) 981-8010.

TYPES OF DATA COLLECTED

We collect only the minimum personal information necessary to provide our services. This may include identifiers such as first name, last name, email address, and phone number; order and payment information, including order details, delivery address (if applicable), and encrypted payment information processed by our third-party payment providers (we do not store full payment card numbers on our systems); internet activity information such as IP address, browser type, device identifiers, pages viewed, referring URL, and cookie identifiers, collected automatically when you use the site; and communications, including any information you provide when you contact us or submit a form.

We use this information solely to take and fulfill orders, process payments, communicate with you about your order or inquiry, operate and secure our site, and, with your consent, send marketing communications.

SENSITIVE PERSONAL INFORMATION

We do not knowingly collect sensitive personal information as defined under the CPRA, including but not limited to Social Security numbers, driver's license or passport numbers, precise geolocation, racial or ethnic origin, religious beliefs, biometric or neural data, health data, sexual orientation, or contents of private communications. We also do not knowingly collect personal information from anyone under the age of 16. If our practices change, we will update this Policy and, where required, provide you with a means to limit the use and disclosure of such information.

METHODS OF PROCESSING

The Owner takes reasonable and appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of personal information. Processing is carried out using computers and IT-enabled tools, following organizational procedures related strictly to the purposes identified. Data may be accessible to certain employees involved in the operation of this website (administration, marketing, IT, legal) and to external service providers (such as hosting providers, payment processors, email service providers, and analytics providers) engaged as service providers or contractors under written contracts that limit their use of the information to the purposes for which it was provided, as required by the CPRA.

LEGAL BASIS FOR PROCESSING

We process personal information on one or more of the following bases: you have given consent for one or more specific purposes; processing is necessary to perform a contract with you or to take steps at your request before entering into a contract; processing is necessary to comply with a legal obligation; or processing is necessary for our legitimate interests, such as securing our site, preventing fraud, and improving our services, where those interests are not overridden by your rights.

PLACE OF PROCESSING

Data is processed at the Owner's operating locations and at the locations of service providers involved in processing. This site is hosted in the United States.

RETENTION

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law. Order and transaction records are retained as required by applicable tax, accounting, and consumer protection laws (generally up to seven years). Marketing contact records are retained until you unsubscribe or request deletion. Website analytics data is retained for up to 26 months.

COOKIES & SIMILAR TECHNOLOGIES

This site uses cookies and similar technologies to operate the site, analyze performance, personalize content, and (with your consent) support advertising and social media features. You can manage cookie preferences at any time through the cookie banner on our site or through your browser settings. For a current list of the specific cookies used on this site, including their provider, purpose, and duration, please see the Cookie Declaration published via our cookie consent tool.

We recognize and honor the Global Privacy Control (GPC) signal for California consumers as an opt-out preference signal in accordance with CCPA regulations.

MORE COOKIE INFORMATION & OPT-OUT CONTROLS