Franchise Privacy Policy

Introduction

IFSA BRANDS LIMITED ("ARTUROS", "we", "us", "our", "us", or "our") are committed to protecting the information we collect from our franchisees (as defined below) in connection with franchising and for the administration of functions related to our franchise business. We are mindful of the need to protect privacy when handling the personal information of our franchisees, and they operate or have operated a restaurant similar to ARTUROS, or are potential or current applicants for an ARTUROS franchise ("you" or "the Franchisee.") This ARTUROS Franchisee Privacy Statement (the "Statement") describes ARTUROS' practices concerning the collection, use, transfer, disclosure and handling of Franchisees' personal information. This Statement may be updated from time to time to reflect changes in our practices concerning personal information, and we will notify you of any significant changes consistent with the "Changes to this Statement" section below, including, as appropriate by posting a notice on ARTUROS' internal or external websites.

Please note that we do share, and in the past 12 months have shared, Franchisees' personal information with our business partners for cross-contextual behavioral advertising purposes as described below, but we do not sell, and in the past 12 months have not sold, our Franchisees' personal information for consideration. In addition, we do not sell or share, and in the past 12 months have not sold or shared, personal information of individuals whose age we know to be less than 18 years old.

Scope

Please note that this Statement does not apply to customers or employees of ARTUROS or to customers or employees of the Franchisees. If you are a customer and would like to learn more about how we process our customers' personal information, please refer to the ARTUROS Global Customer Privacy Statement. If you are an employee of a franchisee, please contact your employer for information about its privacy practices.

Information we collect

We collect personal information for the administration and management of re lations with our Franchisees. The personal information we collect about you varies depending on your situation and the nature of your relationship with us.

During the normal course of operating our business, we collect, and have collected during the past twelve (12) months, the following categories of personal information about Franchisees for the purposes described further below under the section "Purposes for which we collect and process personal information":

• Identifiers and contact information such as real name, suffix, alias, mailing address, unique identification numbers, online identifier, Internet Protocol address, e-mail address, Social Security number, passport number, user names, passwords, (whether assigned by ARTUROS or selected by the user, accounting and payment information), tax identification number, country, bank account, account holder name, bank category, reference details, SWIFT code, bank name and address, payment terms, or payment correspondence (as this qualifies), tax identification number, country, bank account, account holder's name, bank category, reference details, SWIFT code, bank name and address, payment terms, or accounting correspondence (as it qualifies as personal information), real estate information, which may incidentally include personal information, and any other similar identifiers.
• Characteristics of classifications gathered for diversity, equality, inclusion, and other lawful purposes within the ARTUROS Franchise Network, such as race, color, religion, or philosophical beliefs, national origin, sex, gender, sexual orientation, marital status, medical conditions, disability, physical limitation information, special needs or accommodations in the place of employment for health reasons, military service and/or veteran status, residency, work permit status, age (40 years of age or older), and, where permitted by law and justified for the performance of a Franchisee's duties, the results of credit and criminal background checks, drug and alcohol testing, and other vetting procedures. Information about Internet or other electronic network activity, including, but not limited to, information about and/or gathered automatically as part of a user's interaction with the Systems (as defined below); contenido electrónico producido o recibido por usted a través de los Sistemas (incluidos documentos, información, correos electrónicos, y otras comunicaciones electrónicas transmitidas o recibidas a través de los Sistemas); información relacionada con las cuentas del usuario contenidas en los Sistemas, sitios web, o aplicaciones (incluidos los perfiles de cuenta en los sitios web o aplicaciones de ARTUROS y la información almacenada en relación con dichas cuentas, (p. e.g., rights and privileges, activity, interests, preferences, or other information that may be associated with the user's account); information received by ARTUROS when you log in to the Systems, websites, applications, or social accounts or other third party tools. This also includes voicemails, emails, and other correspondence or communications created, stored, or transmitted through ARTUROS's computers, devices, and other communications equipment.
• Geolocation information - If you use certain ARTUROS websites or applications, they may record location data.
• Audio, electronic, visual or similar information, such as photographs, information obtained by security systems, including access cards or other access control systems and closed circuit camera systems.
• Business, professional or employment-related information, including
  • Work and academic history, professional certifications, language skills, references, letters of recommendation, and interview notes
  • Career path within ARTUROS, spouses or family members who might work for ARTUROS and your relationship to them, technical skills, training records, emergency contact information.
  • Information collected in connection with the payment of taxes (such as information collected on standard tax return forms).
  • Confirmation of reading ARTUROS policies, such as our standards of business conduct, as well as information provided in compliance with ARTUROS policies, such as information about potential conflicts of interest or other compliance-related information.
  • Information we collect, including information we obtain from third parties, about content and other information posted on the Internet, (such as information posted on social networking and other public sites on the Internet).
  • Any information necessary to comply with ARTUROS policies or other reporting obligations, or requests from any courts, governmental entities, or law enforcement authorities.
  • Information contained in the Franchisees' application form, such as financial data, resumes of key personnel, background checks, including police records (to the extent these qualify as personal information).
  • Information from the franchise agreement held with the applicable Franchisee ("Franchise Agreement"), including legal business terms and any other contractual documentation, performance information, instances of breach of contract, and information regarding the expiration and termination of the Franchise Agreement (to the extent such information qualifies as personal information).
  • Financial data and data concerning the performance of the relevant Franchisee; financial records, data on the corporations, limited liability companies, partnerships, and trusts that franchisees assign to the ARTUROS restaurants they operate, including direct and indirect shareholders, beneficiaries and trustees, quality control documents and other information relevant to an audit (as it qualifies as personal data).
  • For training purposes, information about the status of your training courses and the date of their completion, as well as test scores, technical data related to your use of the training platform and the device, system, software, and peripherals you use to access the training platform.
• Educational history, defined as information that is not publicly available, personally identifiable information as defined in the Family Educational Rights and Privacy Act. This includes details included in letters of application and resumes/curricula vitae, such as educational institutions attended and academic performance. Inferences derived from any of the data identified in this section for the purpose of creating a profile about an individual that reflects his or her preferences, characteristics, psychological tendencies, predispositions, behavior, attitudes, intelligence, attitudes, and aptitudes.
• Sensitive personal information such as government-issued identification documents (e.g., Social Security and passport numbers), account access credentials or payment card information in combination with credentials that allow account access, precise geolocation data, certain characteristics of protected classifications, such as racial or ethnic origin, postal or email content, and text messages, and biometric data, in each case as detailed above in the relevant categories.

We collect personal information: (1) directly from you and when you provide information to us through the Systems, websites, or applications, such as when you respond to a request for information related to your franchise application and/or dealings or interactions with ARTUROS, use our Systems, websites, applications, or communicate with us; (2) indirectly through your own equipment, computers, devices, or other communications equipment when you communicate with our Systems or applications; (3) indirectly through your own equipment, computers, devices, or other communications equipment when you communicate with our Systems or applications; (4) through our security systems, which includes access cards and other access control systems and closed-circuit television cameras; (5) through other companies and organizations, which includes access cards and other access control systems and closed-circuit television cameras; (3) through our security systems, including access cards and other access control systems and closed-circuit television cameras; (4) through other companies and organizations, such as our partner advertising agencies, social networks, data brokers, payment processors, and other providers; and (5) from public sources.

Purposes for which your personal information is collected and processed

We collect and use personal information for a variety of business purposes including the purposes described in this statement and others compatible with the context in which such information is collected. For example, business purposes include auditing, security and integrity measures, IT scrubbing, short-term or transitory use, provision of services, provision of advertising and marketing services, internal research for technology development and demonstration purposes, or activities to verify or maintain the quality or security of a service or device. We also collect your personal information for the following purposes:

• Administration, management and oversight of franchise relationships (e.g., financial and performance reporting, invoicing, and lease and service charge collection).
• Provision of and assistance with access to ARTUROS and ARTUROS vendor systems and applications used during the course of the relationship with Franchisee (including identity and access management or technologies used in the restaurants).
• Monitoring the security and use of our networks, communications and systems, offices and facilities, property and infrastructure, and information security services are made available to Franchisees as an option.
• Reporting and statistical analysis (e.g., system usage, content access, transaction level detail); optional services provided by ARTUROS and various training platforms.
• Compliance with legal and regulatory obligations, such as compliance with anti-money laundering and trade embargo requirements, including record keeping and reporting obligations.
• Dispute and grievance resolution, internal investigations and evaluations, auditing, compliance with internal policies, risk management.
• The initiation or exercise of legal actions, or the defense against such actions.
• The evaluation of a Franchisee's suitability as a Franchisee, as part of our due diligence process.
• Quality management with respect to our products, services and Systems, and the improvement of the relevant Franchisee's restaurant operation process.

We may also monitor visits to our websites or mobile applications and Franchisees' sessions; this monitoring may track details of your visits to our websites or mobile applications and information generated in the course of using them, such as mouse movements, clicks, page views, text entered, time spent on a particular page, and other details of visits to and actions taken on our websites or mobile applications. We may also share any of the data collected by these technologies with third parties for business purposes.

To the extent that any intended use is inconsistent with those mentioned in this Statement, we will notify you as required by law.

We may anonymize personal information about you or receive personal information about you that has been anonymized, and we may use and disclose such information for any purpose consistent with applicable law. We will retain personal information only for as long as necessary to achieve the purposes described in this Statement, unless a longer retention period is required or permitted by applicable law.

How we share personal information

ARTUROS may share personal information with the following categories of recipients:

• Our subsidiaries, affiliates, and affiliated companies.
• Our third party service providers and consultants. We contractually require these recipients to protect the confidentiality of personal information and to use it only for the purposes for which it was disclosed.
• Credit bureaus and referral service providers.
• Our legal advisors, other professionals and counterparties.
• Governmental or regulatory agencies, including law enforcement agencies, as necessary for ARTUROS to comply with applicable legal or regulatory obligations.
• A purchaser or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of ARTUROS' assets, whether as a going concern or as part of a bankruptcy, liquidation or similar proceeding, in which personal information held by ARTUROS is among the assets transferred.
• Other third parties with your consent or as required or permitted by law.

The following is a list of the third parties with whom we may share your information and the purposes for which we share it:

International transfer of personal information

We may transfer your personal information to countries other than the country in which it is originally located. These countries may not have the same data protection laws as the country in which you originally provided the information. When we transfer your personal information to other countries, we will take steps to protect your information as described in this Statement and in accordance with applicable law.

Security

ARTUROS has implemented reasonable technical and organizational measures designed to protect personal information under our control and safeguard it against loss, misuse, unauthorized access, disclosure, alteration or destruction. For example, we use firewalls, intrusion detection systems and encryption to protect your personal information. We also limit access to personal information to those employees, agents, contractors and other third parties who have a business need to know.

Retention

We will retain personal information only for as long as necessary to achieve the purposes described in this Statement, unless a longer retention period is required or permitted by applicable law. The criteria used to determine our retention periods include:

• As long as we have an ongoing relationship with you;
• If there is a legal obligation to which we are subject; or
• Whether withholding is advisable in light of our legal position (such as with respect to applicable statutes of limitations, litigation or regulatory investigations).

Your Rights

You have the following rights with respect to your personal information:

• The right to access your personal information.
• The right to rectify your personal information.
• The right to delete your personal information.
• The right to restrict the processing of your personal information.
• The right to data portability.
• The right to object to the processing of your personal information.
• The right to withdraw your consent at any time (where processing is based on consent).

To exercise these rights, please contact us as indicated in the "How to Contact Us" section below.

Links to third party websites

Our Sites may contain links to third-party websites that are not owned or controlled by ARTUROS. ARTUROS is not responsible for the privacy practices of these websites. We recommend that you review the privacy policies of these websites before providing them with any personal information.

Changes to this statement

We may update this Statement from time to time to reflect changes in our information practices. We will post any changes on our Sites and notify you of any significant changes as required by law.

How to contact us

If you have any questions or concerns regarding this Statement, please contact us at:

IFSA BRANDS LIMITED

franquicias@arturos.com

Additional information for residents of the European Economic Area

If you are a resident of the European Economic Area, you have the following rights:

• The right to file a complaint with a supervisory authority.
• The right to object to the processing of your personal information for direct marketing purposes.

To exercise these rights, please contact us as indicated in the "How to Contact Us" section above.