As a food-focused, people-first company, our mission of Cultivating a Better World means more than just using real ingredients. It means hiring passionate people and investing in their future. It means championing diversity and celebrating inclusion. It means fostering a culture of well-being for our employees and the environment. So whether you are seeking to join our team to grow your career, chase your passion or just pick up a few skills along the way, we want to help you get a real start.
Chipotle Mexican Grill UK Ltd., Inc. and its subsidiaries, affiliates and related entities (“Chipotle”, “us”, “our”, or “we”) respect and value your privacy. This Recruitment Privacy Notice (“Notice”) describes, in connection with our recruiting processes and programs, the type of information we process, why we are processing it and how that processing may affect you.
If you are an applicant located in the EEA or the UK, the Chipotle entity which would be employing you is the controller of your personal information. As data controller, that Chipotle company is responsible for ensuring that the processing of your personal information complies with applicable data protection law. You can identify your controller and its contact details via the Chipotle name provided on the application process.
By submitting your application to us, you acknowledge and agree that:
- You have read and understood this Notice and agree to the collection, processing, use and disclosure of your personal information as set out in this Notice.
- You are not required to provide any requested information to us, but failure to do so may result in not being able to continue your candidacy for a job with us.
- The information you give us is true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related unfavorable information. Providing any inaccurate information may make you ineligible for employment.
- This Notice applies to the personal information you provide to Chipotle as an applicant for employment, but should not be construed as an offer of employment and does not form part of any contract of employment offered to candidates hired by Chipotle. If you are offered employment at Chipotle, you will be provided with a separate privacy notice addressed to employees.
What do we mean by "personal information" and "processing"?
"Personal information" is information relating to you (or from which you may be identified) which is processed by automatic means or which is (or is intended to be) part of a structured manual filing system. It includes not only facts about you, but also intentions and opinions about you. Data "processed automatically" includes information held on, or relating to use of, a computer, laptop, mobile phone or similar device.
"Processing" means doing anything with your personal information. For example, it includes collecting it, holding it, disclosing it and deleting it.
Personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership and genetic and biometric data are subject to special protection and considered by European privacy law to be "sensitive personal information". This may also be referred to as "special category data".
To Whom Does This Notice Apply?
This Notice only applies to the personal information of job applicants, potential candidates for employment, and those who participate in our recruiting programs and events, that are located in the European Economic Area ("EEA") or the United Kingdom ("UK"). Your personal information is submitted directly to Chipotle through the online application process and follow-up communications and/or through alternative online and off-line channels (e.g., via social media sites, job websites or our third-party recruiting vendors).
This Notice does not apply to personal information about our employees, contractors or customers or to other personal information that Chipotle collects for other purposes, which is subject to separate privacy policies.
What Personal Information Do You Collect & How Do You Use It?
We will collect, process, use and disclose your personal information for the purposes of fulfilling our recruitment practices and in accordance with this Notice, unless there is a conflict with applicable law, in which case, applicable law will prevail. Most of the personal information that we process about you comes directly from you. Other personal information about you is generated from references and third party companies such as recruitment agencies. Your personal information will be seen internally by managers, administrators and HR.
Personal information you provide to us
We usually collect personal information directly from you when you apply for a role with us, such as your name, address, contact information (such as phone number and/or email address), work and educational history, achievements, skills and interests, identity documents, and test results that demonstrate certain skills such as coding. We use this information to evaluate your qualifications and suitability for the desired position, process your application, and contact you about your application.
In order to submit an application through the career portal, you will be required to create an account and provide a username (i.e. email address) and a password that you choose. We use this information to provide and otherwise administer your online account. We strongly recommend that you do not disclose your password to anyone. Chipotle will never ask you for your username or password in any unsolicited communication.
If you sign-up and request to receive job posting notifications by email or text message through the career portal, we will send you notifications of Chipotle jobs that meet your interests and experience. You can stop receiving job alerts by email at any time by following the “unsubscribe” instructions included in each email or replying STOP to any text message.
Personal information we collect automatically
We automatically collect certain device and usage information when you use or interact with our websites or communicate with us electronically. This information includes details about your devices, applications and networks, including internet protocol (IP) address and cookie identifiers.
We may use first party and third-party cookies, web beacons, pixels, clear gifs, and other similar technologies (collectively “Cookies and Other Tracking Technologies”) to identify you and your interests, to remember your preferences, and to track your use of our websites. We also use Cookies and Other Tracking Technologies to control access to certain content on our websites, to protect the websites, and to process any requests that you make of us. You may set your browser to notify you when you receive a cookie or to not accept certain cookies, you may also control your Cookies and Other Tracking Technologies by clicking on the Cookie Preferences link found on the bottom of our website. However, if you decide not to accept cookies from our websites, you may not be able to take advantage of all of the website features.
You can learn more about our use of Cookies and other tracking technologies by reading our Cookie Policy and our Privacy Policy (UK: www.chipotle.co.uk/about-us/privacy-policy , France: www.chipotle.fr/about-us/privacy-policy, or Germany: www.chipotle.de/about-us/datenschutzerklarung) both of which may be found by clicking on the links found on the bottom of our website.
Some of our online recruiting activities conducted on social media sites are hosted by third parties, including the social media sites. When you access sites operated by these third parties, they may place their own Cookies or Other Tracking Technologies on your device.
Personal information provided by third parties
Other personal information about you is generated from references and third party companies such as recruitment agencies and background check providers. In particular:
- Background check providers: If you receive an offer from us, depending on the role, we may then conduct a background check and additional information (as permitted and in the manner permitted by applicable law) on criminal history. Background screening will only be done where permitted by law applicable to the location where the position is located and to the extent necessary and proportionate to the role that you are being offered. A background check will only involve criminal background data to the extent permitted in your specific jurisdiction.
- Professional recruitment firms: We may also collect similar personal information about you from professional recruiting firms
- References: We may collect personal information about you from your references, including prior employers or Chipotle employees who interview you who recommend you join our team.
- Social media platforms: Our application process allows you to apply for a job or provide us with your personal information through third-party websites (e.g., TikTok, LinkedIn, Discord, etc.), including photo and video submissions. We may also collect personal information about you through social media platforms to the extent that you have chosen to make this information publicly available. While your use of those platforms is governed by the third parties' terms of use and respective privacy policy, when we receive your personal information as part of your application to Chipotle or when we collect it as part of your application process, that personal information is used in accordance with this Notice.
We may also use your personal information in an aggregated and/or de-identified form for Chipotle analytics purposes, including to improve our recruitment and hiring process and augment our ability to attract successful candidates.
Legal grounds for processing personal information
What are the grounds for processing?
Under data protection law, there are various grounds on which we can rely when processing your personal information. In some contexts, more than one ground applies. Two of those grounds can be summarized as Legal Obligation and Legitimate Interests. We outline what those terms mean below:
Term | Ground for processing | Explanation |
Legal obligation | Processing necessary to comply with our legal obligations | Ensuring we perform our legal and regulatory obligations. For example, providing a safe place of work and avoiding unlawful discrimination. |
Legitimate Interests | Processing necessary for our or a third party's legitimate interests | We or a third party have legitimate interests in carrying on, managing and administering our respective businesses effectively and properly and in connection with those interests processing your data. Your personal information will not be processed on this basis if Chipotle's or a third party's interests are overridden by your own interests, rights and freedoms. |
Processing sensitive personal information
At Chipotle, we believe in authenticity as one of our company’s values and encourage everyone to bring their most authentic and best self to come work for us. As such, we may collect sensitive personal information about you to support our efforts to create an inclusive and diverse work environment. When we do so, it will be done in compliance with legal requirements and on a completely voluntary basis.
If we process sensitive personal information about you, as well as ensuring that one of the grounds for processing mentioned above applies, we will make sure that one of the grounds for processing sensitive personal information applies, including (for example) that the processing is for equality and diversity purposes to the extent permitted by law.
Further information on our legal bases for processing
Examples of the personal information, purposes and grounds on which we process your personal information are in the table below. The examples in the table cannot, of course, be exhaustive.
Purpose | Examples of personal information that we process | Grounds for processing |
Recruitment | Information concerning your application and our assessment of it, the fact of your application and our record of it, your references, any checks we may make to verify information provided or background checks and any information connected with your right to work. If relevant, we may also process information concerning your health, any disability and in connection with any adjustments to working arrangements. | Legal obligation Legitimate interests |
Contacting you or others on your behalf | Your address and phone number, references you provide, emergency contact information and information on your next of kin | Legitimate interests |
Security | CCTV images | Legal obligation Legitimate interests |
Monitoring of diversity and equal opportunities | Information on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability and age | Legal obligation Legitimate interests |
How Do We Share Your Personal Information?
Your personal information may be disclosed to managers, HR and administrators for employment, administrative and management purposes as mentioned in this Notice.
In addition, we may share personal information with third parties (including and other entities in our group) who provide services on our behalf, including hosting the career portal, assisting with our recruitment efforts, and assessing job applications, or with other entities in our group as part of our regular reporting activities.
International Transfers
We are headquartered in the United States, but we are a global business with group entities, restaurants and personnel located in Canada, the UK, and countries in the EEA.
Your personal information may be transferred to the third parties mentioned in the section above (including our group companies) in the United States and Canada or other foreign jurisdictions. We ensure that the transfer is lawful and that there are appropriate security arrangements in place to protect your personal information. We have entered into agreements ensuring appropriate and suitable safeguards with our group members and third party service providers. If you wish to see details of these safeguards, please email privacy@chipotle.com.
How Long Do We Keep Your Personal Information?
If you accept an offer of employment with us, any relevant personal information collected during your pre-employment period will become part of your personnel records and will be retained to meet our legal requirements and business needs. We will treat all such personal information in accordance with our Employee Privacy Notice.
If we do not employ you, we may continue to retain and use your personal information for a reasonable period of time to consider you for potential future roles. Irrelevant data such as CCTV images may be deleted after a short period. Thereafter, we may retain, in accordance with our documented retention policies, a minimal amount of your personal information to record your recruiting activity with us.
Security
We use generally accepted standards of technical, physical and operational security designed to protect personal information. Only authorized personnel of Chipotle and of our third-party service providers are permitted to access the personal information you submit directly to us as part of the application process, and these employees and third-party service providers are required to treat this information as confidential and to implement appropriate security measures. Despite these precautions, we cannot guarantee that unauthorized persons will not obtain access to your personal information.
Your Rights And Choices
We try to be as open as we reasonably can about personal information that we process. At any time, you can contact us to modify, correct or delete the personal information that you provided at the time of your job application submission.
If you are located in the EEA or the UK, you may also have certain legal rights. This would include to make an access request. If you exercise this right and we hold personal information about you, we are required to provide you with certain information, including a description and copy of the personal information and an explanation of why we are processing it. In addition, you may have a legal right to have your personal information rectified or erased, to object to its processing or to have its processing restricted. You may also have the right to be given your personal information in a machine readable format for transmitting to another data controller, though this right is may not be relevant to you in the context of our recruitment processes.
If you make a legal request and there is any question about who you are, we may require you to provide information to satisfy ourselves as to your identity.
We are unlikely to rely on consent as a ground for processing. However, if we do, you may withdraw consent at any time — though such withdrawal will not affect the lawfulness of what we have done before you withdraw consent.
If you want to exercise your rights and choices, or if you have any complaints relating to our processing of your personal information, please contact us by using the contact details provided below. You may also raise complaints with the statutory regulator in your jurisdiction. Contact details for data protection authorities in the EEA and the UK are available here.
Contact Us
If you want to contact us (including if have any questions about this Notice or any complaints), our contact details are as follows:
Email: privacy@chipotle.com
By registered mail:
In the European Economic Area:
Chipotle Mexican Grill France SAS
6 place de la Madeleine
75008 Paris
France
In the United Kingdom:
Chipotle Mexican Grill UK Ltd.
83 Baker Street,
London,
W1U 6AG
If you are an applicant located in the EEA or the UK, the Chipotle entity which would be employing you is the controller of your personal information. As data controller, that Chipotle company is responsible for ensuring that the processing of your personal information complies with applicable data protection law. You can identify your controller and its contact details via the Chipotle name provided on the application process.
Changes To This Notice
We may change this Notice from time to time. If we make any changes to this Notice, we will post an amended version and change the "Last Updated" date above.