Last Updated: June 13, 2023
This Privacy Policy (this “Policy”) applies to the public policy advocacy program (“DashRoots”) operated by DoorDash, Inc. and its group companies (collectively, “DoorDash,” “we,” “us,” or “our”). DoorDash is a technology company that connects people with the best of their neighborhoods by enabling local businesses to meet consumers’ needs of ease and convenience, and, in turn, generate new ways for people to earn, work, and live. DashRoots’ goal is to build a network of members who provide voices for local neighborhoods and to engage, cultivate and activate the DashRoots members to advocate for policies and laws, including, without limitation, policies and laws that empower local economies. DashRoots is available for any individual residing in the United States to join and to participate in the available public policy advocacy activities. DashRoots members do not need to be consumers, dashers, or merchants of DoorDash’s products and services. There are three groups of members within DashRoots: (1) members who participate in only the standard public policy advocacy program; (2) members who also participate in the virtual and/or in-person public policy advocacy events; and (3) members who agree to be captains (or other similar designation) to help facilitate or organize virtual and/or in-person public policy advocacy. For captains (or other similar designation) additional terms, agreements, and requirements may apply.
This Policy explains how we process (e.g., collect, use, store, protect, and/or disclose) personal information when we are acting in the data processing role or capacity of a Controller (as defined below). This Policy applies to personal information relating to individuals who are currently members of DashRoots and individuals who sign-up or join through DoorDash’s DashRoots sign-up page. Please note that, if you are an individual using DoorDash’s other services and/or platforms (e.g., a consumer, dasher, and/or merchant), DoorDash may connect information collected under or in connection with this Policy, with information collected in connection with your consumer, dasher, and/or merchant account and information collected under a separate DoorDash privacy policy.
The term “Controller” means the natural or legal person that, alone or jointly with others, determines the purposes and means of processing personal information. In this Policy, all references to a “business” means DoorDash, all references to a “consumer” means you, and all references to “you” or “your” shall mean an individual whose personal information is processed subject to this Policy.
- Data Processing Generally.
In connection with DashRoots, DoorDash will process personal information to allow you to register for and participate in public policy advocacy activities in connection with DashRoots, which activities will include, but not be limited to, (i) receiving communications about DashRoots from or on behalf of DoorDash and/or its corporate affiliates, (ii) creating and initiating the transmission of communications to legislators, legislative bodies, regulators and/or other government entities, agencies, and departments to advocate on policies and laws, (iii) participating in discussions, meetings, and interviews with DoorDash and DashRoots members, and (iv) for certain approved DashRoots members, participating or engaging in the virtual and/or in-person public policy advocacy activities with media, news, and/or journalism companies or agencies, legislators, legislative bodies, regulators and/or other government entities, agencies, and/or departments. In addition, certain members designated as captains (or other similar designation) may process personal information (e.g., contact information included within the category of identifiers) of other members to facilitate and/or organize public policy advocacy activities. - Categories of Personal Information Collected.
- Notice At Collection:
- Categories of Personal Information We May Collect:
- Identifiers: Information and identifiers such as a real name, alias, postal address, unique
personal identifier, online identifier, Internet Protocol address, email address, phone
number, or other similar identifiers. - Inferences Information: Inferences drawn from any of the information to create a profile about a consumer in relation to DashRoots and qualification for certain DashRoots activities reflecting the individual’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
- Communications Data: Such as the nature and content of communications, date and time sent, etc.
- Advocacy Activity Information: Information related to your participation in the advocacy activities in connection with DashRoots
- Social Media Information: Information related to your postings on your available or accessible social media accounts.
- Public Records information: information available from conducting public record searches on individuals as part of a check on individuals interested in participating in the virtual and/or in-person advocacy activities and/or for being a captain (or other similar designation for DashRoots).
- Identifiers: Information and identifiers such as a real name, alias, postal address, unique
- Categories of Personal Information We May Collect:
- Notice At Collection:
ii. Business and Commercial Purposes for Which Personal Information May be Processed. DoorDash may process, and share with the categories of parties identified in Section 2.B.ii. of this Policy, your personal information for the purposes set forth below.
Purposes Categories of Personal Information Onboarding you as a member of DashRoots (e.g., when you sign-up to DashRoots)
iii. Retention of Personal Information. For the categories of personal information collected and processed, the personal information is retained in accordance with Section 6.C. of this Policy.
iv. Categories of Personal Information that we May Sell or Share (as these terms are defined under applicable data protection and privacy laws) and the Purpose(s) for Which the Personal
Information May be Sold or Shared.
None, as we do not sell or share personal information in connection with DashRoots.
B. Collection, Use and Disclosure.
This section describes, for the preceding twelve (12) months and generally, the categories of (i) the sources from which personal information is collected, (ii) the parties with whom personal information is disclosed (including personal information disclosed for our business and commercial purposes), and (iii) the personal information disclosed for business and/or commercial purposes.
i. Categories of Sources From Which We Have Collected and May Collect the Personal Information.
ii. Categories of Parties with Whom We Have Disclosed and Will Disclose the Personal Information for our Business or Commercial Purposes.
iii. Categories of Personal Information We Have Disclosed for a Business Purpose. Please see the categories of personal information disclosed in Section 2.A.i. of this Policy.
3. Communications.
In connection with your participation in DashRoots, we may send you communications regarding theDashRoots program generally, about opportunities to participate in public policy advocacy, and about your participation in DashRoots. The communications may be transmitted or made via email, telephone and/or text message; however, DashRoots does not make calls delivering automated or prerecorded message calls and does not send text messages via an autodialer. For communications that contain an opt-out mechanism, you can opt-out of receiving communications through that specific
opt-out mechanism. You can also opt-out through contacting DoorDash as described in Section 5 of this Policy.
4. Children’s Personal Information.
DashRoots is only available for individuals who are eighteen (18) years of age or older. If you are under the age of eighteen (18), please do not sign-up for DashRoots or participate in or attempt to participate in any DashRoots activities. If we become aware that any personal information that we collected is associated with an individual under the age of eighteen, we will delete the personal information.
5. Your Rights and Choices.
You may have rights under certain data protection and privacy laws pertaining to our processing of your personal information. These rights are not absolute, meaning that, as permitted under applicable data protection and privacy laws, we may not be obligated to comply with your request and we can limit the frequency of your requests. For all requests, we will need to verify the identity of the data subject and, if applicable, the identity and authority of the person submitting the request on behalf of the data subject (e.g., authorized representative). If we are unable to confirm or validate the identity of the data subject and, if applicable, the identity and authority of the requestor if different than the data subject, then we may reject or deny the request. Subject to applicable data protection and privacy laws, you can exercise your rights free of charge.
The rights that may be available to you include rights to (i) access or know what personal information we process (and data portability), (ii) delete your personal information, (iii) opt-out of the sale or sharing (as the terms sale or sharing are defined under applicable data protection and privacy laws) of personal information, (iv) opt-out of targeted advertising, (v) opt-in after opting out, (vi) correct or rectify your personal information, (vii) appeal a decision made by DoorDash with regards to your rights request, (viii) not experience discrimination and/or retaliation as a result of exercising a right provided under applicable data protection and privacy laws, (ix) limit the use and disclosure of sensitive personal information, (x) withdraw consent, (xi) opt-out of profiling, and (xii) opt-out or unsubscribe from certain communications from us in connection with DashRoots.
Please note that opting-out or unsubscribing from communications for DashRoots will only apply to DashRoots and will not apply to DoorDash’s separate products and services and if you opt-out or unsubscribe through a mechanism in one channel then the opt-out or unsubscribe request will only apply to communications sent through the specific channel for which the opt-out or unsubscribe request was exercised (e.g., if you opt-out through an opt-out mechanism in an email, then the opt-out request will only apply to email communications). Following receipt of an opt-out request, DoorDash may send a one-time communication to confirm the opt-out.
In connection with DashRoots and for compliance with applicable data protection and privacy laws (including, without limitation, California and Nevada laws), we do not believe that DoorDash is selling or sharing personal information and DoorDash is not engaging in targeted advertising.
To exercise your rights, please submit your request to DoorDash via email at DashRoots@doordash.com and in the subject line include “Privacy Request”. If you do not have access to email or based on your personal preference, you may exercise any of the rights available toyou by calling us at our toll free number: (855) 973-1040. When exercising any rights in relation toDashRoots, please make sure to provide the following information: (i) first and last names, (ii) email address, (iii) reference that your request relates to DashRoots, and (iv) the specific right(s) that you wish to exercise.
6. Storage, Security and Retention of Personal Information.
- A. Storage of Personal Information.
The personal information processed in connection with this Policy may be stored and processed on servers located in the United States and other global locations. Accordingly, personal information may be transferred to, and stored and processed in, a country or countries outside of the country in which you reside. - B. Security of Personal Information.
DoorDash has implemented administrative, organizational, technical, and physical security controls that are designed to safeguard personal information. However, no online activity is ever fully secure or error-free. While we strive to protect your information, we cannot guarantee that your personal information is absolutely secure. Please keep this in mind when disclosing any information to DoorDash. Please recognize that protecting your personal information is also your responsibility. We urge you to take every precaution to protect your information when you are on the Internet, or when you communicate with us and with others through the Internet. Change your passwords as appropriate, use a combination of letters and numbers, and make sure you use a secure browser. If you have reason to believe that your interaction with us is no longer secure, please let us know immediately by contacting us as indicated in Section 9 of this Policy. - C. Retention of Personal Information.
- Our retention of your personal information may vary based upon the nature of our relationship with you and based upon several factors, including without limitation, the following:
- (1) The length of time necessary to fulfill the purpose(s) for which we collected the personal
information in connection with DashRoots; - (2) When your relationship with DashRoots ceases or terminates;
- (3) The length of time it is reasonable to keep records to demonstrate that we have fulfilled our
business and legal duties and obligations and contractual commitments (as applicable); - (4) Any limitation periods within which claims can be made;
- (5) Any retention periods prescribed by law or prescribed or recommended by regulators,
professional bodies, or associations; and - (6) The existence of any relevant legal proceedings.
- (1) The length of time necessary to fulfill the purpose(s) for which we collected the personal
7. California Compliance.
A. California Privacy Rights Act (“CPRA”) Notice of Financial Incentives.
Under the CPRA, we are required to provide certain disclosures regarding “financial incentives” offered in exchange for your disclosure of personal information to us. While we do not believe that we are offering financial incentives in exchange for your disclosure of personal information, we want to provide transparency regarding how certain costs and expenses are covered by DoorDash. For the individuals who participate in the virtual and/or in-person public policy advocacy activities DoorDash will arrange and pay for, or will reimburse members for, travel, lodging and/or meal costs and expenses incurred in connection with participation in the virtual and/or in–person public policy advocacy activities. If we arrange and directly pay for such costs and expenses, no compensation will be paid or provided by us directly to the members. If the member arranges for and pays for such costs and expenses, we will either reimburse the member directly or provide reimbursement in the form of community credits that can be used by the member on DoorDash’s consumer marketplace. If you do not wish to participate in the virtual and/or in-person public policy advocacy activities and to receive reimbursement for expenses or costs
associated with participating in such advocacy activities, you should not participate in such advocacy activities.
In connection with virtual and/or in-person public policy advocacy activities, certain members may receive small or nominal gift bags or packages consisting of a DoorDash t-shirt, mug, pen, and/or other similar items. If you do not wish to participate in the virtual and/or in-person public policy advocacy activities and receive the small or nominal gifts, you should not participate in such advocacy activities.
B. CPRA Metrics.
DoorDash has not processed any requests to know or delete personal information in connection with DashRoots.
C. California Shine the Light.
The “Shine the Light” requirements under California Civil Code §1798.83 do not apply to the individuals covered under this Policy because our processing activities in connection with DashRoots are not covered by this law.
D. CPRA Rights.
Under the CPRA, you have certain rights, which are described in Section 5 of this Policy.
8. Third-Party Sites.
Some of the functionality in connection with DashRoots may be provided by third parties and may contain links to other third-party websites that are not controlled by DoorDash. These third parties are not under our control and DoorDash is not responsible for their privacy policies or practices. If you provide any personal information to any third party or through any such third-party website, we recommend that you familiarize yourself with the privacy policies and practices of that third party.
9. Contact Us.
If you have any questions or concerns relating to this Policy or our privacy practices, please contact us at privacy@doordash.com or:
DoorDash, Inc.
Attn: Legal
303 2nd St, Suite 800
San Francisco, CA 94107
Help Form: https://help.doordash.com/consumers/s/contactsupport
10. Updates to this Policy.
This Policy may be subject to updates from time to time with or without notice. We recommend that you periodically review this Policy. In the event of any changes to this Policy, we will determine whether or not notice is required and, if notice is required, we will provide appropriate notice taking into account the nature of the changes. Your continued participation in or with DashRoots after any updates to this Policy constitutes your agreement and acceptance of this Policy as updated. In the event that you disagree with the changes, your only remedy is to cease participating in or with DashRoots.