PRIVACY POLICY LAST UPDATED: February 23, 2021 This Privacy Policy explains how information about you is collected, used and disclosed by ChebaHut or its affiliates or authorized operators (collectively, “Cheba Hut,” “our,” “we” or “us”). This Privacy Policy applies to information we collect when you use our website, mobile application and other online products and services (collectively, the “Services”) or when you otherwise interact with us. We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy and, in some cases, we may provide you with additional notice, such as adding a statement to our homepage or sending you an email notification. We encourage you to review the Privacy Policy whenever you access the Services or otherwise interact with us to stay informed about our information practices and the ways you can help protect your privacy. Collection of Information. Information You Provide Us. We collect information you provide directly to us. For example, we collect information when you create an account, place an order or make a purchase, fill out a form, participate in contests, promotions or surveys, apply for a job, inquire about becoming an authorized operator (including, but not limited to, a franchisee), contact us about potential real estate locations, host a charity fundraiser at one of our stores or request charity donations from us, engage with us via third party social media sites, request customer support or otherwise communicate with us. The types of information we may collect include: your name, email address, phone number, postal address, ZIP code, birth date, ChebaHut account username and password, social media usernames; if you are applying for employment, your r�sum� information, such as employment and education history; if you are inquiring about becoming our authorized operator, your net worth and restaurant operation experience; if you are requesting our participation in a fundraising event or seeking charity donations from us, name and address of the charity organization, event details and tax exempt ID; or any other information you choose to provide; and any other information you give us, such as to participate in a promotion, purchase a gift card, or to contact customer service. Information We Collect Automatically When You Use the Services. When you access or use our Services, we automatically collect certain information, including, but not limited to: Transaction Information: When you place an order or make a purchase, we collect information about the transaction, such as the items ordered, the transaction amount, and the date and location of the store of your order. We may also collect and store limited payment information from you, such as payment card type, expiration date, and the last four digits of your card number; however, we do not collect or store full payment card numbers and all transactions are processed by our third-party payment processors. Log Information: We collect log information about your access and use of our website, including but not limited to, your domain name, the type of browser you use, access times, pages viewed, your IP address and the page you visited before navigating to our Services. Device Information: We collect information about the computer or mobile device you use to access our Services, such as the hardware model, operating system and version, unique device identifiers, mobile network information, and browsing behavior. Location Information: We may collect information about the precise location of your device each time you access or use our website or one of our mobile applications or otherwise consent to the collection of this information. For more details, please see “Your Choices” below. Information Collected by Cookies and Other Tracking Technologies: CCTV Information: Closed circuit video surveillance cameras may be installed at some of our retail locations to monitor building security and assist in crime prevention, detection, and investigation, and to ensure the health and safety of our staff and visitors to our facilities. We and our service providers use various technologies, including cookies and web beacons, to collect information about you and our interaction with our Services, including information about your browsing and purchase behavior. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience on these Services, see which areas and features of our Services are popular and count visits. Web beacons are electronic images that may be used in our Services or emails and help deliver cookies, count visits and understand usage and campaign effectiveness. For more information about cookies, and how to disable them, please see “Your Choices” below. Information We Collect from Other Sources. We may also receive information about you from other sources and link or combine that with information we collect about you. For example, if you create or log into your account through a social media site or if you associate your social media account with your ChebaHut account, we will have access to certain information from that site, such as your name, account information and friends lists, in accordance with the authorization procedures determined by such social media site. Information We Collect About Others. In some cases, we may also collect information you provide about others, such as when you refer someone to our Services (such as for certain promotions), or when you make a purchase for others or specify items for others in your party. We will use this information to fulfill your requests and will not send 2communications to your contacts unrelated to your requests, unless they separately consent to receive communications from us. We do not intend for our websites or online services to be used by anyone under the age of 13. If you are a parent or guardian and believe we may have collected information about your child, contact us immediately. Use of Information. We may use information about you for various purposes, including, but not limited, to: Provide, maintain and improve our Services, including your in-store, online and mobile application ordering experience; Provide and deliver the products and services you request, process orders, transactions and send you related information, including confirmations and receipts; Send you technical notices, updates, security alerts and support and administrative messages; Investigate and prevent fraudulent transactions and other illegal activities; Respond to your comments, questions, requests and provide customer service; Communicate with you about products, services, offers, promotions, rewards, and events offered by ChebaHut and others, and provide news and information we think will be of interest to you (for information about how to manage promotional communications, please see “Your Choices” below); Monitor and analyze trends, usage and activities in connection with our Services; Personalize and improve the Services and provide advertisements, content or features that match user profiles or interests; Process and deliver contest and promotion entries and rewards; Link or combine with information we get from others to help understand your needs and provide you with better service; Assess and respond to employment, franchise/authorized operator, charity events or donations, or other applications; or Carry out any other purpose for which the information was collected. ChebaHut is based in the United States and the information we collect is governed by U.S. law. By accessing or using the Services or otherwise providing information to us, you consent to the processing and transfer of information in and to the U.S. and other countries, where you may not have the same rights as you do under local law. Sharing of Information. We may share information about you as follows or as otherwise described in this Privacy Policy: With our affiliates, subsidiaries and authorized operators to provide products and services you request and to support our business function and authorized operator network; With third-party vendors, consultants and other service providers who need access to such information to carry out work on our behalf; In response to a request for information if we believe disclosure is in accordance with any applicable law, regulation or legal process, or as otherwise required by any applicable law, rule or regulation; If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property and safety of ChebaHut or others; In connection with, or during negotiations of, any merger, sale of company assets, listing of our securities with a securities exchange, financing, reorganization, or acquisition of all or a portion of our business by another company; and With your consent or at your direction. We may also use and share aggregated or de-identified information, which cannot reasonably be used to identify you. Social Sharing Features. The Services may offer social sharing features and other integrated tools (such as the Facebook “Like” button), which let you share actions you take on our Services with other media, and vice versa. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features. Advertising and Analytics Services Provided by Others. We may allow others to serve advertisements on our behalf across the Internet and to provide analytics services. These entities may use cookies, web beacons and other technologies to collect information about your use of the Services and other websites, including your IP address, web browser, pages viewed, time spent on pages, links clicked and conversion information. This information may be used by ChebaHut and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites and better understand your online activity. For more information about interest-based ads, or to opt out of having your web browsing information used for behavioral advertising purposes, please visit www.aboutads.info/choices. We may also work with third parties to serve you ads as part of a customized campaign on third-party platforms (such as Facebook or Twitter). As part of these ad campaigns, we may convert information about you, such as your email address and phone number, into a unique value that can be matched with a user account on these platforms to allow us to learn about your interests and to serve you advertisements customized to your interests. Note that the third-party platforms may offer you choices about whether you see these types of customized advertisements. Security. ChebaHut takes reasonable measures to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. Your Choices. Account Information. You may update, correct or delete account information at any time by logging into your account. If you wish to deactivate your account, please send an email to [email protected], and include your name, account name (if different), contact information, and a request to deactivate your account. Please note, however, that we may retain certain information that you provide through our Services as required by law or for legitimate business purposes. We also may retain cached or archived copies of information about you for a certain period of time. Cookies. Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that, if you choose to remove or reject cookies, this could affect the availability and functionality of our Services. Location Information. When you first launch some of our mobile applications or visit one of the pages on our website that collect location information, you may be asked to consent to the collection of location information. If you initially consent to our collection of location information, you can later stop this collection by changing the settings on your mobile device or Internet browser. If you do so, certain features of our Services will no longer function. You can also stop our collection of location information by our mobile application(s) by following the standard uninstall process and removing the ChebaHut application(s) from your mobile device. Promotional Communications. You may opt out of receiving promotional communications from us by following the instructions in those communications or by editing the preferences of your account. If you opt out, we may still send you non-promotional communications, such as those about your account, your transactions or our ongoing business relations. Mobile Push Notifications/Alerts. With your consent, we may send promotional and non-promotional push notifications or alerts to your mobile device. You can elect to stop receiving these messages at any time by changing the notification settings on your mobile device.

Additional Disclosures for California Residents: In the preceding twelve months we may have disclosed these categories of personal information for a business purpose: We collect identifiers from the information you voluntarily provide to us; from the information we automatically collect; and from other sources, as outlined above.  We collect identifiers to provide our services; to communicate with you; for research and development and services improvement; and to comply with applicable laws, and as otherwise outlined above. Personal information under California Civil Code section 1798.80: We collect Section 1798.80 information from the information you voluntarily provide to us; from the information we automatically collect; and from other sources, as outlined above for the purposes as outlined above; and we share identifiers with our service providers, to protect lawful interests, and for any other purpose with your consent as outlined above. Commercial information: We collect commercial information from the information you voluntarily provide to us; from the information we automatically collect; and from other sources, as outlined above; and we collect and share commercial information with our service providers and affiliates o provide our services; to communicate with you; for research and development and services improvement; and to comply with applicable laws, and as otherwise outlined above. Electronic network activity information: We collect network information as outlined above from the information you voluntarily provide to us; from the information we automatically collect; and from other sources, as outlined above; and we collect and share electronic network activity information with our service providers and affiliates o provide our services; to communicate with you; for research and development and services improvement; and to comply with applicable laws, and as otherwise outlined above. Geolocation data: We collect geolocation information as outlined above from the information you voluntarily provide to us; from the information we automatically collect; and from other sources, as outlined above; and we collect and share geolocation information with our service providers and affiliates o provide our services; to communicate with you; for research and development and services improvement; and to comply with applicable laws, and as otherwise outlined above. Inferences: We develop inference data through the information as outlined above from the information you voluntarily provide to us; from the information we automatically collect; and from other sources, as outlined above; and we collect and share inference data information with our service providers and affiliates o provide our services; to communicate with you; for research and development and services improvement; and to comply with applicable laws, and as otherwise outlined above. How We Sell Your Information – In the preceding twelve months we have not sold personal information. We do not sell personal information, but we recognize that the CCPA defines “personal information” in such a way that making available identifiers linked to you for a benefit may be considered a “sale.” In addition to the above’s description for opting out of interest-based advertising and controlling browser settings, California consumers may also use the Digital Advertising Alliance’s tool to send requests under the CCPA for a web browser to opt out of the sale of personal information by some or all of that framework’s participating companies by accessing the DAA’s tool here: https://www.privacyrights.info/, or by downloading the DAA’s AppChoices mobile application opt-out here: https://www.privacyrights.info/appchoices.

Access to Specific Information and Data Portability Rights – Subject to certain exceptions, if you are a California resident you have the right to request a copy of the personal information that we collected about you during the 12 months before your request. Once we receive your request and verify your identity, we will disclose to you:

The categories of personal information we have collected about you;

The categories of sources for the personal information we have collected about you;

Our business or commercial purpose for the information collection;

The categories of third parties with whom we share that personal information;

The specific pieces of personal information we collected about you;

Deletion Request Rights – You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.

Opting Out – As described in “How We Sell Your Information” above, California residents have the right to opt-out of having their personal information sold.

Non-Discrimination – California residents may not receive discriminatory treatment by the business for exercising your CCPA rights.

Exercising Access, Data Portability, and Deletion Rights – To exercise the access, data portability, and deletion rights described above as a California resident, please submit a verifiable consumer request to us. Please note that in order to verify your request, we may require you to verify personal information that we already have on file for you or to provide additional information.

Use of an Authorized Agent to Submit a Request – Only you or a person you formally authorize to act on your behalf, may make a verifiable consumer request related to your personal information as a California consumer. If you use an authorized agent to submit such a request, we will require written proof that the authorized agent has been authorized to act on your behalf or a copy of the power-of-attorney document granting that right.

Direct Marketing – If you are a California resident, you can request a notice disclosing the categories of personal information we have shared with third parties for the third parties’ direct marketing purposes. To request a notice, please submit your request to [email protected]

Contact Us. If you have any questions about this Privacy Policy, please contact us at [email protected]