1.Who we are and what this policy covers
CTR Food Works (“CTR,” “we,” “us,” or “our”) is a food hall and bar inside the former CNN Center, 190 Marietta St NW, Atlanta, GA 30303. CTR is part of the Gansevoort Companies family of food halls, which also includes Chattahoochee Food Works and Vela Park Food Works. This website is operated by CTR together with the affiliated companies that own, manage, and operate the hall, including Baconboy Hospitality LLC.
This Privacy Policy explains how we collect, use, share, and protect personal information when you visit ctrfoodworks.com (the “Site”), send us a message, join our email list, or start a private-event inquiry through the Site. It also covers the staff dashboard our team uses to run the Site.
It does not cover what happens inside the hall or elsewhere offline. The independently owned kitchens in the hall run their own point-of-sale and ordering systems, and their privacy practices apply to anything you share with them. The property’s own website (thectratlanta.com), which the Site links to, and the other businesses in the building have their own practices too.
2.Information we collect
We collect what we need to run the Site and to respond to you.
Information you give us
- Messages. When you use the contact form on the Connect page, we collect your first and last name, your email address, the type of inquiry you choose (General, Private Events, Press, Partnerships, or Careers), and your message. If you reply by email to one of our responses, we keep your reply together with the original message so our team can follow the whole conversation.
- Email list. When you join our email list through the welcome pop-up or the sign-up section on the home page, we collect your email address and note which of those forms you used.
- Event inquiries. The private-event inquiry form on the Private Events page is provided by Tripleseat, the event-management software we use. You enter details such as your name, contact information, event type, date, and guest count, and the form sends them to our Tripleseat account.
Please do not send payment card numbers, government ID numbers, passwords, or detailed health information through the Site. If you write to us about a job, we use what you send to consider you for roles. If you have a food allergy or dietary need, share only what is necessary to help us plan, and tell the kitchen directly when you order.
Information collected automatically
- Technical data. Like most websites, our servers and our hosting provider receive your IP address, browser and device type, the pages you request, the date and time, and the page that referred you. We use this to deliver pages, keep the Site secure, and diagnose problems.
- Google Analytics and Google Ads. The Site loads Google’s tag, which measures how the Site is used and which of our ads lead to inquiries. What it may store on your device and send to Google depends on the choice you make in our cookie banner. Details are in Cookies, analytics, and advertising.
- Abuse prevention. To stop spam and automated attacks, we limit how often forms and sign-in pages can be used. For that we use your IP address after scrambling it with a secret value (a hash), so the stored counter does not reveal it. The counters expire automatically after a short time, from minutes to about an hour.
- Browser storage. The Site saves two small items in your browser’s local storage: your choice in the cookie banner, and whether you have already closed the welcome pop-up. They stay on your device and are not used to track you.
- Embedded content. The Visit page shows a Google map, and the event inquiry form loads software from Tripleseat and Google reCAPTCHA, a spam-protection tool. When these load, those companies receive your IP address and browser details and may set their own cookies. Their handling of that data is governed by their own policies, linked below.
Staff dashboard accounts
If you are a member of our team or a contractor we have invited to the Site’s dashboard, we keep your name, work email address, role, a hashed (not readable) password, an optional profile photo, and the records needed to keep your account secure, such as password-reset requests. A sign-in cookie keeps you signed in and expires after one hour. These accounts are not open to the public.
Information from other sources
Our service providers send us the information you submit through them (for example, Tripleseat passes along your event inquiry), and a planner, assistant, or colleague may contact us on your behalf. Google also gives us reports about how people use the Site and respond to our ads, which we use in aggregate.
3.Cookies, analytics, and advertising
The Site uses Google’s tag to run Google Analytics 4, which measures how the Site is used, and Google Ads, which measures which of our ads lead to inquiries. We use them to understand traffic, improve the Site, and judge whether our advertising is working.
Your choice
When you first visit, a banner asks you to choose “Necessary only” or “Accept all.” Analytics and advertising storage start switched off and stay off unless you choose “Accept all.”
- If you choose “Accept all,” Google may set cookies and use identifiers on your device to measure visits and ad performance, and, under Google’s own settings and policies, to show you ads on Google services. When you then submit our contact form, we also send Google a scrambled (hashed) version of the name and email address you entered, so it can tell us the inquiry came from one of our ads. This is called enhanced conversions. The scrambling happens in your browser before anything is sent.
- If you choose “Necessary only,” or have not chosen yet, the Google tag is told not to set analytics or advertising cookies or to use identifiers for advertising. The tag still loads, so Google receives the limited signals that any web request carries, such as the page address, your browser details, and your IP address, along with your choice. Google says it uses these cookie-free signals to model overall traffic and conversions. We do not send Google your name or email address.
Whichever you choose, when a contact form is submitted the Site tells Google Ads that a form was submitted. That tells Google the event happened, with no name or email attached unless you chose “Accept all.” Your inquiry reaches us as normal either way, and your choice has no effect on how we respond to you.
Changing your choice
To change your choice later, clear this site’s data (cookies and local storage) in your browser settings. The banner comes back the next time you load a page. You can also email inquiries@ctrfoodworks.com and we will help. To limit Google’s personalized advertising across the web, use Google’s ad settings. To opt out of Google Analytics on all sites, Google offers a browser add-on. You can also read how Google uses information from sites that use its services.
Other cookies and storage
Apart from Google, the only storage the Site sets is the browser storage described above and, for signed-in staff, the sign-in cookie. Google Maps and the event inquiry form (Tripleseat and reCAPTCHA) may set cookies of their own when you load or use them. We do not use social-media tracking pixels. You can block or delete cookies and local storage in your browser settings; the Site will still work, but embedded features such as the event inquiry form may not.
Do Not Track and Global Privacy Control
The Site does not currently read Do Not Track or Global Privacy Control signals from your browser. Because analytics and advertising storage start switched off, you can keep them off by choosing “Necessary only.” If you would like help, email inquiries@ctrfoodworks.com.
4.How we use information
We use personal information to:
- respond to your messages and to press, partnership, careers, and event inquiries;
- plan, quote, and manage private events and partnerships;
- send the email updates you asked to receive, which you can stop at any time;
- operate, maintain, and secure the Site, including preventing spam, fraud, and abuse;
- measure and improve the Site and our programming, and understand which of our ads lead to inquiries;
- administer staff accounts; and
- comply with the law, respond to lawful requests, and protect our guests, our team, and our rights.
We do not use personal information to make automated decisions that have legal or similarly significant effects on you.
5.How we share information
We do not sell your personal information for money. We share personal information only in these ways.
Service providers
These companies handle personal information on our behalf to provide their services. Google and Tripleseat also describe their own practices in the policies linked here.
- Vercel. Hosts the Site and stores uploaded images, such as event artwork and staff profile photos. Privacy policy
- Neon. Hosts the database that stores contact messages, email-list sign-ups, event listings, and staff accounts. Privacy policy
- Resend. Sends and receives the emails our forms and dashboard produce, including routing your message to the right team and relaying replies. Privacy policy
- Tripleseat. Provides the private-event inquiry form and the event-management software we use to respond. Privacy policy
- Google. Provides Google Analytics and Google Ads measurement (see Cookies, analytics, and advertising), the map on the Visit page, and reCAPTCHA spam protection on the event inquiry form. Privacy policy
Advertising and analytics
If you choose “Accept all,” Google receives the identifiers, activity data, and hashed contact details described in Cookies, analytics, and advertising. Some state privacy laws describe that as “sharing” for cross-context behavioral advertising or as “targeted advertising.” It happens only after you choose “Accept all,” and you can stop it at any time as described there.
Affiliates
We may share information with other food halls and hospitality businesses under common ownership with us, including those in the Gansevoort Companies portfolio. For example, our event inquiry form is shared across several halls, so an inquiry may be reviewed by an events team that serves more than one venue.
Legal, safety, and business reasons
We may disclose information to comply with a law, subpoena, or court order; to protect the rights, property, or safety of our guests, our team, or the public; to investigate fraud or security issues; or in connection with a merger, sale, financing, or transfer of some or all of our business, in which case the information may transfer to the new owner.
With your direction
We share information when you ask us to, for example if you ask us to introduce you to a kitchen or a partner.
De-identified information
We may use or share information that cannot reasonably be used to identify you.
6.How long we keep information
We keep personal information only as long as we need it for the purposes above, and then delete or de-identify it. In practice:
- email-list addresses are kept until you unsubscribe or ask us to delete them;
- messages and event inquiries are kept for as long as needed to answer you and manage the related event or request, and afterward for our business, tax, and legal records;
- technical logs and abuse-prevention counters are short-lived and are managed by our providers;
- data that Google holds through its analytics and advertising tools is kept under Google’s own retention settings and policies; and
- deactivated staff accounts are permanently deleted after a short retention period (currently 90 days).
7.How we protect information
We use safeguards that are reasonable for a site of this size, including encrypted connections (HTTPS), hashed staff passwords, role-based access limited to authorized team members, limits on repeated sign-in and form attempts, spam controls, and one-hour staff sessions.
No website or email system is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the authorities as the law requires.
8.Your choices and rights
- Cookies and advertising. Choose “Necessary only” in the cookie banner, or change an earlier choice, as described in Cookies, analytics, and advertising.
- Email. Every marketing email has an unsubscribe link, and you can also email us to opt out. We will stop promptly, and in any event within 10 business days. We may still send messages about a request you made.
- Access, correction, and deletion. You can ask us what personal information we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Email inquiries@ctrfoodworks.com with “Privacy request” in the subject line, send a message through our contact page (choose General and say it is a privacy request), or write to the address below, and give us enough detail to find your records. We will ask you to confirm that you control the email address you used. We aim to respond within 45 days, and if we need more time we will tell you why.
We will not treat you differently for exercising any of these choices.
9.Additional information for residents of certain states
Depending on where you live, state privacy laws may give you rights over your personal information, including the right to know and access it, correct it, delete it, receive a portable copy, opt out of sale, targeted advertising, and certain profiling, and appeal if we refuse a request. We do not sell personal information for money and we do not use it for profiling that has legal or similarly significant effects. If you choose “Accept all” in the cookie banner, our use of Google’s advertising tools may count as “sharing” or “targeted advertising” under some of these laws, and you can opt out at any time by choosing “Necessary only,” as described in Cookies, analytics, and advertising. We extend the other choices described in Your choices and rights to all visitors, wherever you live.
To make a request, use the methods in that section. You may also use an authorized agent; we may ask for proof of the agent’s authority and may need to verify your identity. If we decline a request, you may appeal by replying to our decision with “Appeal” in the subject line, and if you are not satisfied with the outcome you may contact your state attorney general.
We do not knowingly collect sensitive personal information as those laws define it, apart from anything you choose to include in a message.
California
To the extent California law applies to us, these are the categories of personal information we have collected in the past 12 months, with where they came from, what we used them for, and who received them. We have not sold personal information for money. Where a visitor chose “Accept all,” Google could use online identifiers and activity information for advertising, which California law may treat as “sharing.”
- Identifiers. Examples: Name, email address, IP address, and, only if you chose “Accept all,” online identifiers such as cookie or device IDs. Source: You and your browser. Used for: Responding to you, security, running the Site, and, if you chose “Accept all,” measuring our advertising. Disclosed to: Our service providers; Google (online identifiers and hashed name and email, only if you chose “Accept all”).
- Customer records (California Civil Code § 1798.80(e)). Examples: Name, email address, and the content of your messages and inquiries. Source: You. Used for: Responding to you, planning events and partnerships. Disclosed to: Our service providers.
- Internet or similar network activity. Examples: Browser and device type, pages viewed, referring page, request timing, how you use the Site, and whether you reached us from one of our ads. Source: Your browser, our servers, and Google. Used for: Delivering and securing the Site, understanding how it is used, and measuring our advertising. Disclosed to: Our service providers; Google.
- Approximate location. Examples: City-level location that Google Analytics works out from your IP address. Source: Google. Used for: Understanding where our visitors come from. Disclosed to: Google.
- Professional information and photos (staff only). Examples: Name, work email, role, profile photo. Source: Staff members. Used for: Administering dashboard accounts. Disclosed to: Our service providers.
California residents may also ask once a year for details about personal information we disclosed to third parties for their direct-marketing purposes. We make no such disclosures. Nevada residents may ask us not to sell their covered information; we do not sell it.
10.Children’s privacy
The Site is meant for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us and we will delete it.
11.Links to other sites and services
The Site links to other websites and services, including the kitchens’ own websites, the property’s website, social platforms such as Instagram, Google Maps, and Tripleseat. We do not control them and are not responsible for their privacy practices, so please read their policies before sharing information with them.
12.Visitors from outside the United States
We operate in, and store information in, the United States. If you use the Site from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.
13.Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows the current version. If we make a material change, we will take reasonable steps to let you know, such as posting a notice on the Site. Using the Site after an update means you accept the updated policy.
