XML 23 R11.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management, Strategy and Governance | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management & Strategy Our management is principally responsible for defining the various risks facing us, formulating risk management policies and procedures, and managing our risk exposures on a day-to-day basis. Our information is processed, transmitted, and stored in a secure environment using hardened, proven enterprise-grade technologies to protect both our data and the physical computing assets. We guard against business interruption by maintaining a disaster recovery plan, which includes storing critical business information in multiple off-site data centers, testing the disaster recovery plan at a host-site facility, and providing fault tolerant devices, communication services, and utilities. We have independent third-party cybersecurity audits conducted no less than annually, following a framework modeled after the National Institute of Standards and Technology standard. We also have third-party security reviews and testing of our network, processes and systems conducted on a regular basis. We use internally developed proprietary software, cloud-based software as a service (“SaaS”) as well as purchased software, with proven, non-proprietary hardware. While we believe that our internal policies, systems and procedures for cybersecurity are thorough, the risk of a cybersecurity event cannot be eliminated. We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply or our systems are compromised, we could be subject to government enforcement actions, private litigation and adverse publicity. We maintain a robust system of data protection and cybersecurity resources, technology and processes. In addition to performing an annual risk assessment and developing a mitigation plan, along with a comprehensive review and update of our cybersecurity policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. We also monitor risks relating to sensitive information at our business partners, where relevant, and reevaluate the risks at these partners periodically. We make strategic investments to address these risks and compliance requirements to keep Company, guest and team member data secure, including maintaining a network privacy and security insurance policy. Although we have purchased cyber liability insurance to provide a level of financial protection should a data breach occur, such insurance may not cover us against all claims or costs associated with such a breach. Our comprehensive cybersecurity program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. We perform annual and ongoing cybersecurity awareness training for our management and Restaurant Support Center team members as well as specialized training for our users with privileged access. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. Governance The Audit Committee receives data protection and cybersecurity reports quarterly from our Chief Information Officer, which the Audit Committee shares with the full Board of Directors. The Board of Director's responsibility is to monitor our risk management processes by understanding our material risks and evaluating whether management has reasonable controls in place to address those risks. The involvement of the Board in reviewing our business strategy is an integral aspect of the Board’s assessment of management’s tolerance for risk and what constitutes an appropriate level of risk. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to certain risks to the Audit Committee. As such, the Audit Committee is responsible for reviewing our risk assessment and risk management policies. Accordingly, management regularly reports to the Audit Committee on risk management, and in turn, the Audit Committee reports on the matters discussed at the Committee level to the full Board. The Audit Committee and the full Board focus on the material risks facing us, including operational, technology and cybersecurity, reputational, market, credit, liquidity and legal risks, to assess whether management has reasonable controls in place to address these risks. Our cybersecurity risk management and strategy processes are led by our Chief Information Officer and our Director of Cybersecurity and Infrastructure. These individuals have collectively over 40 years of professional experience in various and progressive roles across multiple, regulated industries involving developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing information security infrastructure and operations, risk assessment and mitigation, and satisfactorily managing multiple industry and regulatory compliance environments. Prior to their current roles, both individuals previously held positions at other large publicly traded organizations where they were the chief stewards of cybersecurity strategy and operations.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Role of Management [Text Block] | The Audit Committee receives data protection and cybersecurity reports quarterly from our Chief Information Officer, which the Audit Committee shares with the full Board of Directors. The Board of Director's responsibility is to monitor our risk management processes by understanding our material risks and evaluating whether management has reasonable controls in place to address those risks. The involvement of the Board in reviewing our business strategy is an integral aspect of the Board’s assessment of management’s tolerance for risk and what constitutes an appropriate level of risk. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to certain risks to the Audit Committee. As such, the Audit Committee is responsible for reviewing our risk assessment and risk management policies. Accordingly, management regularly reports to the Audit Committee on risk management, and in turn, the Audit Committee reports on the matters discussed at the Committee level to the full Board. The Audit Committee and the full Board focus on the material risks facing us, including operational, technology and cybersecurity, reputational, market, credit, liquidity and legal risks, to assess whether management has reasonable controls in place to address these risks. Our cybersecurity risk management and strategy processes are led by our Chief Information Officer and our Director of Cybersecurity and Infrastructure. These individuals have collectively over 40 years of professional experience in various and progressive roles across multiple, regulated industries involving developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing information security infrastructure and operations, risk assessment and mitigation, and satisfactorily managing multiple industry and regulatory compliance environments. Prior to their current roles, both individuals previously held positions at other large publicly traded organizations where they were the chief stewards of cybersecurity strategy and operations.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to certain risks to the Audit Committee. As such, the Audit Committee is responsible for reviewing our risk assessment and risk management policies.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our cybersecurity risk management and strategy processes are led by our Chief Information Officer and our Director of Cybersecurity and Infrastructure. These individuals have collectively over 40 years of professional experience in various and progressive roles across multiple, regulated industries involving developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing information security infrastructure and operations, risk assessment and mitigation, and satisfactorily managing multiple industry and regulatory compliance environments. Prior to their current roles, both individuals previously held positions at other large publicly traded organizations where they were the chief stewards of cybersecurity strategy and operations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Audit Committee receives data protection and cybersecurity reports quarterly from our Chief Information Officer, which the Audit Committee shares with the full Board of Directors. The Board of Director's responsibility is to monitor our risk management processes by understanding our material risks and evaluating whether management has reasonable controls in place to address those risks. The involvement of the Board in reviewing our business strategy is an integral aspect of the Board’s assessment of management’s tolerance for risk and what constitutes an appropriate level of risk. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to certain risks to the Audit Committee. As such, the Audit Committee is responsible for reviewing our risk assessment and risk management policies. Accordingly, management regularly reports to the Audit Committee on risk management, and in turn, the Audit Committee reports on the matters discussed at the Committee level to the full Board. The Audit Committee and the full Board focus on the material risks facing us, including operational, technology and cybersecurity, reputational, market, credit, liquidity and legal risks, to assess whether management has reasonable controls in place to address these risks.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration