Privacy Policy

We collect and use several types of information from and about you, including: • Personal information that we can reasonably use to directly or indirectly identify you, such as your name, mailing or location address, email address, telephone number, Internet protocol (IP) address, and any other identifier we may use to contact you (“personal information”). The specific personal information we collect depends on how you interact with us, as described under How We Collect Information About You below.

• Non-personal information that does not directly or indirectly reveal your identity or relate to an identifiable individual, including demographic information and statistical or aggregated information. We may derive non-personal statistical or aggregated data from personal information. For example, we may aggregate information to calculate the percentage of users accessing a specific Website feature.

• Technical information, including your browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, or information about your internet connection, the equipment you use to access our Website, and usage details.

• Details about your Website interactions, including full Uniform Resource Locators (URLs), clickstream to, through, and from our Website (including date and time), pages or menu content you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).

We use different methods to collect your information, including through: • Direct interactions with you when you provide information to us, for example by completing forms on our Website or corresponding with us by phone, email, or otherwise.

• Automated technologies or interactions, as you navigate through our Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies and other tracking technologies.

• Third parties or service providers, for example our ordering, analytics, advertising, and mapping providers.

The information we collect directly from you on or through our Website may include the following, depending on how you interact with us: • Franchise inquiries. If you submit a franchise inquiry, we may collect your name, email address, phone number, current role, location information, preferred market or area of operation, business and hospitality experience, financial capacity, opening timeline, relocation willingness, intended business role, full-time operation intent, single-unit or multi-unit interest, and any notes or comments you provide.

• Catering inquiries. If you submit a catering inquiry, we may collect your name, email address, phone number, selected store, catering inquiry details, and event or order-related notes.

• Contact and complaint forms. If you contact us or submit a complaint, we may collect your name, email address, phone number, the store or location involved, the details of your complaint or inquiry, and any other information you choose to submit.

• Correspondence. Records and copies of your correspondence (including email addresses) if you contact us. Our Website does not currently offer customer accounts, online ordering, or payment functionality directly. Where you place an order, create an account, or make a payment, you do so through PAR, Punchh, and Fiserv, and the information you provide is collected and handled by those providers in accordance with their own privacy practices.

Our Website offers a store locator that helps direct you to your closest Lazeez Shawarma location.

Lazeez Shawarma does not store exact GPS coordinates. However, the Website may process or retain the following types of location-related information: • Select store details from form submissions (e.g., catering inquiries).

• Browser or locally stored preferred store information.

• IP addresses and user agents, collected for security and rate-limiting purposes.

• Catering lead form details, including customer information, event details, notes, and requested items.

• Analytics events that may capture store name or store slug when users interact with locations features, ordering, or forms. Browser geolocation is only triggered when a user explicitly searches for the nearest store. Your use of the location feature is also subject to Google’s privacy practices.

As you navigate through and interact with our Website, we may use cookies and other automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including: • Details of your visits to our Website, including traffic data, location data, logs, and other communication data, and the resources that you access and use on the Website.

• Information about your computer and internet connection, including your IP address, operating system, and browser type. The information we collect automatically may include personal information, and we may maintain it or associate it with personal information we collect in other ways. It helps us to improve our Website and deliver a better and more personalized service, including by enabling us to estimate audience size and usage patterns, store information about your preferences, recognize you when you return to our Website, and measure the effectiveness of our advertising. The technologies we use for this automatic data collection may include: • Cookies (or browser cookies). A cookie is a small file placed on your device. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Website.

• Web beacons. Pages of our Website and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics.

We use the following third-party tools on our Website to understand how the Website is used, to support and measure our advertising, and to manage our local listings: • Google Analytics and Google Tag Manager, to analyze how visitors use the Website and to manage our tags and measurement tools.

• Google Ads, including remarketing and retargeting, to deliver and measure advertising and to show relevant ads to people who have visited our Website.

• Meta Business Manager, to deliver and measure advertising on Meta platforms.

• Google Business Profile and Google Business Manager, to manage our store locations and local listings. These third parties may use cookies, web beacons, and similar technologies to collect information about your online activities over time and across different websites and online services. They may use this information to provide you with interest-based (behavioural) advertising or other targeted content. We do not control these third parties’ tracking technologies or how they are used. If you have questions about an advertisement or other targeted content, you should contact the responsible provider directly.

You can opt out of several third-party ad networks’ cookies at the same time using the opt-out tool created by the Digital Advertising Alliance of Canada. Opting out does not mean you will no longer receive online advertising; it means the network from which you opted out will no longer deliver ads tailored to your web preferences and usage patterns. See Choices About How We Use and Disclose Your Information below.

We use information that we collect about you, or that you provide to us, including any personal information: • To present our Website and its contents to you.

• To respond to your inquiries, including franchise and catering inquiries, and to route catering inquiries to the selected store.

• To manage and respond to customer complaints and support requests.

• To help you locate nearby Lazeez Shawarma locations.

• To support your journey to the PAR online ordering platform and, where applicable, the mobile application, loyalty program, account linkage, and order history through PAR and Punchh.

• To analyze Website performance and usage, and to maintain Website performance and security.

• To conduct and measure advertising, remarketing, retargeting, and analytics through the tools described above.

• To fulfill the purposes for which you provided the information or that were described when it was collected.

• To comply with our legal obligations and enforce our rights.

• To send you promotional communications where you have consented, if and when we add email or SMS promotional signup (see Marketing Communications below).

• For any other purpose with your consent.

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect, or that you provide, as described in this policy to the following categories of parties, depending on your interaction with us: • PAR and Punchh, for online ordering, the mobile application, loyalty, customer accounts, and order history.

• Fiserv, for payment processing through the PAR platform.

• Uber Direct, for delivery fulfillment.

• Google (including Google Analytics, Google Tag Manager, Google Ads, Google Business Profile, Google Business Manager, and Google location analytics) and Meta Business Manager, for analytics, advertising, location, and local listings.

• Website hosting, development, and maintenance providers, and other analytics, advertising, and retargeting providers that support our business.

• Our internal teams, including our Franchise Development Team for franchise inquiries, our Franchise Operations Team and the selected store for catering inquiries, our Franchise Operations and Franchise Support Team for complaints and contact submissions, and our Privacy Officer and support team for privacy and data requests.

• Legal, accounting, compliance, or regulatory parties, where required or appropriate.

We require service providers that handle personal information on our behalf to keep it confidential, to use it only for the purposes for which we disclose it to them, and to protect it with safeguards consistent with this policy and applicable law. We may also disclose your personal information: • To comply with any court order, law, or legal process, including to respond to any government or regulatory request, in accordance with applicable law.

• To enforce or apply our Terms and Conditions of Use and other agreements.

• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others, including for fraud protection and risk reduction.

• In connection with a merger, reorganization, sale, or transfer of some or all of the Company’s assets, in accordance with applicable law.

Some of our service providers, including providers of ordering, payment, analytics, advertising, and mapping services, may process, store, or transfer your personal information outside of your province or outside of Canada, including in the United States. Where this occurs, your personal information may be subject to the laws of those jurisdictions, and the governments, courts, law enforcement, or regulatory agencies of those jurisdictions may be able to obtain access to it under their laws. Whenever we engage a service provider, we require that its privacy and security standards be consistent with this policy and applicable Canadian privacy legislation. By submitting your personal information or engaging with the Website, you consent to this transfer, storage, or processing.

Our Website does not currently offer newsletter, coupon, SMS, or promotional signup functionality. We plan to add email or SMS promotional signup in the future. If and when we do, we will obtain consent in accordance with Canada’s Anti-Spam Legislation (CASL) and applicable privacy laws before sending you commercial electronic messages. Separately, the Lazeez Shawarma mobile application and the Punchh platform may send emails, SMS messages, and push notifications in connection with online ordering and the loyalty program. These communications are managed through PAR and Punchh and are subject to the consent and preference settings of those platforms. Where we send you commercial electronic messages, we will include an unsubscribe mechanism. You may unsubscribe at any time by using the unsubscribe link in our messages or by contacting our Privacy Officer using the contact information below. Some communications, such as messages about a specific order or inquiry, are not promotional and may continue even if you opt out of marketing messages.

We strive to provide you with choices regarding the personal information you provide to us:

• Tracking technologies and advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of this Website may not function properly.

• Interest-based advertising. You can opt out of several third-party ad networks’ cookies at the same time using the opt-out tool created by the Digital Advertising Alliance of Canada, and you can use the settings provided by Google and Meta to manage the ads you see.

• Promotional communications. If we have sent you a promotional email or message, you may unsubscribe using the mechanism in the message or by contacting our Privacy Officer.

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to protect your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Website. Any transmission of personal information is at your own risk.

If we become aware of a privacy or data security incident involving personal information, our internal team, including Operations, will be notified and will assess the incident. Operations will determine whether the matter needs to be escalated, including to legal counsel, and whether affected individuals or regulators need to be notified, in each case in accordance with applicable law.

Except as otherwise permitted or required by applicable law, we retain your personal information only for as long as reasonably necessary to fulfill the purposes for which we collected it, for legitimate business purposes, or as required or permitted by law. Where appropriate, we may anonymize personal information so that it can no longer be associated with you, in which case we may use that anonymized information for legitimate business purposes. Our current retention positions for information collected through the Website are summarized below. These positions may be refined as our internal retention schedule is finalized.

Franchise inquiries

• Retained until deletion is requested • Franchise leads may be long-term and relevant for future development. Catering Inquiries

• 1 Year • Used for inquiry follow-up, customer service, and operational reference. Customer Complaints

• Retained until deletion is requested • Used for complaint history, repeat issues, operational tracking, dispute handling, and compliance. Privacy and Data Requests

• Retained until deletion is requested • Maintains a record of how we handled privacy and data requests. Marketing Consent Records

• While subscribed, plus 1 year after unsubscribe • Supports proof of consent and unsubscribe history. Location-related data, IP addresses, user agents, and analytics events

• data.Exact GPS coordinates are not stored by the Company. IP addresses and user agents are retained for security and rate-limiting purposes in accordance with operational needs. Selected store details and catering lead data are retained consistent with the catering inquiry retention period (1 year). Browser/local preferred store data is stored locally on the user’s device, not on Company servers. Analytics events (store name or store slug) are retained in accordance with Google Analytics data retention settings.

Our Website is intended for a general audience and is not directed to children. We do not knowingly collect personal information from children below the age of majority in their province or territory of residence without appropriate consent. If you are below the age of majority, please do not provide any personal information to us through the Website. If we learn that we have collected personal information from a child without appropriate consent, we will take steps to delete that information. If you believe we might have any information from or about a child, please contact us using the information below.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. Subject to applicable law, you have the right to request access to, and correction of, the personal information that we hold about you. To review, verify, correct, or request deletion of your personal information, or to withdraw consent to its use, please contact our Privacy Officer using the information below. We may request specific information from you to confirm your identity and your right to access. Applicable law may allow or require us to refuse access to some or all of the personal information we hold about you. If we cannot provide access, we will inform you of the reasons, subject to any legal or regulatory restrictions. Examples of exceptions include information protected by solicitor-client privilege, information that is part of a formal dispute resolution process, information that would reveal another individual’s personal information, and information that is prohibitively expensive to provide.

Where you have provided consent to the collection, use, or transfer of your personal information, you may have the legal right to withdraw your consent in certain circumstances. To withdraw your consent, contact our Privacy Officer using the information below. Please note that if you withdraw your consent, we may not be able to provide you with a particular product or Service, and we will explain the likely impact to you at the time.

We are committed to making our Website accessible. If you encounter an accessibility barrier on our Website, or if you would like to provide accessibility feedback, please contact us at the email address below. Our Operations team handles accessibility feedback and reports of website accessibility barriers.

It is our policy to post any changes we make to this privacy policy on this page. If we make material changes to how we treat our users’ personal information, we will provide notice on the Website. We include the date this policy was last revised at the top of the page. You are responsible for periodically visiting our Website and this policy to check for changes.

We welcome your questions, comments, and requests regarding this privacy policy and our privacy practices. For all privacy and data requests, please contact:

Privacy Officer

Lazeez Shawarma

405-101 Britannia Road East

Mississauga, ON L4Z 3E6

support@lazeezshawarma.com

Our Operations team monitors privacy and data requests, and the email address above is our authorized contact point for these requests. We have procedures in place to receive and respond to complaints or inquiries about our handling of personal information, our compliance with this policy, and applicable privacy laws.