Privacy Policy

Rustic Roots Pizza and Pasta is a small, family-run restaurant located at 383 Main St, Enosburg Falls, Vermont 05450, United States. We operate this website to share our menu, allow online ordering for pickup, respond to inquiries, and provide information about our restaurant.

We respect your privacy and are committed to protecting the personal information you share with us. This policy describes what we collect, why we collect it, how we use it, and the choices you have. It applies to all visitors to our website and all customers who place orders through it.

This policy is written to comply with applicable privacy laws, including the Vermont Consumer Protection Act, the California Consumer Privacy Act (CCPA) as amended by the CPRA, and — where relevant — the European Union's General Data Protection Regulation (GDPR). If you have any questions, you can always contact us using the details at the end of this document.

We collect two kinds of information: information you give us directly, and information collected automatically as you use the website.

Information you provide to us

• Order information. When you place a takeout order, we collect your name, phone number, pickup time, order details, and any notes or special instructions you provide.
• Contact form information. When you use our contact form, we collect your name, email address, subject, and the message you write to us.
• Newsletter information. When you subscribe to our email newsletter, we collect your email address.
• Catering inquiry information. When you submit a catering request, we collect your name, email, event date, number of guests, package preference, and the details you provide.
• Cookie preference. When you accept our cookie banner, we store a flag in your browser's local storage indicating that preference.

Information collected automatically

When you visit our website, our hosting provider automatically records certain technical information, including your IP address, browser type and version, operating system, referring URLs, pages you visit, and the date and time of your visit. This information is stored in server logs and is used only for security, diagnostics, and aggregate traffic analysis. We do not link server logs to any individually identifiable person.

We do not use advertising trackers, third-party analytics platforms, pixel tags, or cross-site trackers. We do not use Google Analytics or any equivalent service. The only third-party requests made by our website are to Google Fonts and Font Awesome (for visual resources) and Google Maps (for the embedded map, only on pages where it appears).

We use the information described above for the following purposes:

• To fulfill your orders. We use your name, phone number, and pickup time to prepare your order and hand it to you at the correct time. We may call the phone number you provide if there is an issue with your order.
• To respond to inquiries. If you submit a contact or catering form, we use the information you provide to reply to you and, where applicable, to prepare a quote.
• To send newsletters. If you subscribe, we use your email address to send you occasional updates about our restaurant, events, and menu. You can unsubscribe at any time by clicking the unsubscribe link in any email or by replying to any email we send.
• To improve the website. Aggregate traffic data helps us understand which pages are useful and which are not, so we can improve them.
• To maintain records. We keep order records for accounting, tax, and customer service purposes.
• To comply with legal obligations. In rare cases, we may be required to disclose information to comply with applicable law, a court order, or a lawful request from a public authority.

We do not use your information for automated decision-making, profiling, or targeted advertising. We do not sell your information. We do not rent your information. We do not share your information with data brokers or advertising networks.

If you are located in the European Economic Area or the United Kingdom, we process your personal information under the following legal bases:

• Contract. We process order information to fulfill our contract with you — that is, to prepare and hand over your order.
• Consent. We process newsletter subscription information based on your consent, which you may withdraw at any time.
• Legitimate interests. We process contact form information and server logs based on our legitimate interest in responding to inquiries, operating a secure website, and improving our services.
• Legal obligation. We process order records where required to comply with tax and accounting law.

If you are located in California, we do not "sell" or "share" personal information for cross-context behavioral advertising purposes as defined by the CCPA. We do not collect sensitive personal information beyond what is necessary to fulfill your order.

We share information only in narrow, defined circumstances:

• Service providers. Our website is hosted by a third-party hosting provider. Our email newsletter is delivered by a third-party provider. These providers process data on our behalf and are contractually required to protect it and to use it only for the purposes we specify.
• Legal requirements. We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfer. If our restaurant is sold, merged, or otherwise transferred to new ownership, customer information may be among the assets transferred. We will notify you by email or by prominent notice on the website before your information is transferred and becomes subject to a different privacy policy.

We do not sell your information. We do not share your information with any third party for that party's own marketing purposes.

We retain information only as long as necessary for the purposes described in this policy:

• Order records are retained for seven years to comply with tax and accounting requirements.
• Contact and catering inquiries are retained for two years from the date of last contact, unless we are actively working with you, in which case they are retained until the relationship ends.
• Newsletter subscriptions are retained until you unsubscribe, at which point your email address is removed from our list within 30 days.
• Server logs are retained for 30 days and then deleted.

Depending on where you are located, you may have some or all of the following rights regarding your personal information:

• Right to access. You may request a copy of the personal information we hold about you.
• Right to correction. You may request that we correct inaccurate or incomplete information.
• Right to deletion. You may request that we delete your personal information, subject to legal retention obligations.
• Right to restrict processing. You may request that we restrict how we process your information.
• Right to data portability. You may request that we provide your information in a structured, machine-readable format.
• Right to object. You may object to the processing of your information based on legitimate interests.
• Right to withdraw consent. Where processing is based on consent, you may withdraw that consent at any time.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, please contact us using the details at the end of this document. We will respond to your request within 30 days (or 45 days if the request is complex, in which case we will notify you). We may need to verify your identity before processing the request.

If you are located in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, you have the right to know what categories of personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information (we do not sell or share).

We take reasonable and appropriate measures to protect the information we hold. These measures include encrypted connections (HTTPS) for all data transmitted through our website, restricted access to order records (only the owner and manager can view them), and storage of order records on a server that is not directly accessible from the internet.

That said, no method of transmission over the internet and no method of electronic storage is completely secure. We cannot guarantee absolute security. If you believe your information has been compromised, please contact us immediately.

Our website is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13 years of age. If you are a parent or guardian and you believe your child has provided us with personal information, please contact us and we will delete it. If we discover that a child under 13 has provided us with personal information, we will delete that information promptly.

Our website and servers are located in the United States. If you access our website from outside the United States, your information will be transferred to, stored, and processed in the United States. United States data protection laws may differ from those in your country. By using our website and providing us with your information, you consent to this transfer.

We may update this Privacy Policy from time to time to reflect changes in our practices or to comply with legal requirements. When we make a material change, we will notify subscribers by email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of the website after any change constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, or if you wish to exercise any of your rights, please contact us:

We aim to respond to all privacy-related inquiries within five business days.