Dunkin' (the copyright holder listed as DD IP Holder LLC, operating brand Dunkin' Brands) is a coffee-and-donut chain acquired by Inspire Brands, a private restaurant-holding company, in an $11.3 billion deal in 2020 per Inspire's own site. Dunkin's privacy policy states it collects account, loyalty (DDPerks), demographic and voice-interaction data, and separately discloses that it supplements collected data by purchasing demographic data from data brokers, and by drawing on social-network and publicly available sources. The policy discloses sharing with service providers, affiliates (for the affiliates' own direct marketing), and partners for co-branded products, sales/distribution and joint marketing. Most significantly, the New York Attorney General announced a September 2020 settlement resolving a 2019 lawsuit alleging Dunkin' failed to investigate and respond to ongoing credential-stuffing cyberattacks that compromised tens of thousands of customer accounts; the settlement required customer notification/refunds, security improvements, and $650,000 in penalties and costs — a regulator order, placing track record at the bottom tier per methodology.
TRACK RECORD
1 ENFORCEMENT ACTION
[2020-09-15]
The New York Attorney General announced a September 15, 2020 settlement with Dunkin' Brands, Inc. resolving a lawsuit alleging the company failed to investigate ongoing credential-stuffing cyberattacks that compromised tens of thousands of customer online accounts; the settlement required Dunkin' to notify and refund affected customers, implement security safeguards against future attacks, and pay $650,000 in penalties and costs.
Dunkin's privacy policy states it collects account, contact, credentials, and demographic data (including gender and birth month/day) when users register, join the DDPerks loyalty program, or interact with Customer Care, and separately discloses that it purchases demographic data from data brokers to supplement collected data, along with drawing on social-network and publicly available sources.
Inspire Brands' own corporate website states its CEO led 'the $11.3 billion acquisition of Dunkin' Brands in 2020,' and Inspire's brand portfolio page lists Dunkin' as one of its owned restaurant brands alongside Arby's, Baskin-Robbins, Jimmy John's, Buffalo Wild Wings and SONIC.
Dunkin's own privacy policy footer names the copyright holder for the DD/BR Online Services as 'DD IP Holder LLC,' and states Dunkin' Brands, located at 130 Royall Street, Canton, MA, acts as the data controller (or as processor on behalf of a franchisee, in which case the franchisee's own policy applies).
The privacy policy states Dunkin' may disclose personal information to third-party service providers, to its own Affiliates for the Affiliates' own direct marketing purposes, and to partners with which it co-brands services, sells or distributes its products, or engages in joint marketing activities.
The New York Attorney General announced a September 15, 2020 settlement with Dunkin' Brands, Inc. resolving a lawsuit alleging the company failed to investigate ongoing credential-stuffing cyberattacks that compromised tens of thousands of customer online accounts; the settlement required Dunkin' to notify and refund affected customers, implement security safeguards against future attacks, and pay $650,000 in penalties and costs.
The privacy policy describes its use of Cookies to track online activity and purchases, and states that to opt out of online interest-based advertisements, users must go through the Digital Advertising Alliance's Self-Regulatory Program for Online Behavioral Advertising (via aboutads.info) or the Network Advertising Initiative, confirming participation in third-party interest-based ad networks with advertisers and partners.