Privacy Policy

1. Scope of the Data Protection Policy

We ("Company" or "we" or "our") are committed to protecting your personal data. This privacy policy ("Privacy Policy") describes how we collect and process data that can be used to directly or indirectly identify you ("Personal Data") when you interact with us through our digital offerings (including our websites and mobile applications ("Apps"), social media channels, stores, events, or other products and services). It also describes how your Personal Data is used, shared, and protected, the choices you have regarding your Personal Data, and how you can contact us.

For some of our products or services, the way we use or collect your personal information may differ from the provisions of this Policy. In such cases, we will clearly link to dedicated policies within this Policy where appropriate. We reserve the right to modify this Privacy Policy from time to time. If we make material changes to this Policy (for example, changes that affect the personal information we collect or how or why we use it), we will notify you of those changes and the date of the changes at the top of this Policy.

2. Who is responsible for processing your personal data?

Which company is responsible for processing your personal data ("Data Controller") depends on how you interact with us and where you are located in the world. The respective Data Controller is identified for each data processing activity in this Policy.

With respect to specific products or services for the purposes set out in this Policy, two companies, or a company and another third party ("joint controllers"), may jointly determine how your personal data is used. Whenever we act as joint controllers, we act in accordance with a specific agreement that defines the allocation of agreed roles and responsibilities of each party to fulfill their obligations. Such joint control arrangements will, in particular, govern:

• How and which joint controller informs the data subjects about the underlying data processing;

• which joint controller is designated as the contact point for communication with data subjects and supervisory authorities; and

• which joint controller is responsible as the contact point for reporting a data security breach to supervisory authorities and data subjects.

Further details on joint controllership are provided in the specific section on each processing of personal data.

3. How do we collect personal information from you?

There are several ways we may collect your personal information, depending on how you interact with us. Below are some examples. For more detailed information about each category of personal information we collect, please see the "How and Why We Use Your Personal Information" section.

• Personal information you provide directly to us : You may provide your personal information directly to us, for example, when you use our websites or apps, participate in our events or promotions, subscribe to our newsletters, purchase our products or services, create a user account, visit one of our restaurants, or communicate with us through one of our social media platforms.

• Personal Information We Collect Automatically : When you visit our websites or apps, we may collect certain types of information automatically, such as information about your visit or page interactions.

• Personal information we receive from other sources : We may also receive information about you from other sources when you use one of our websites, apps, or services. We also work closely with third parties (including, for example, subcontractors for technical, payment, and delivery services), credit reference agencies (for example, when you shop in our web stores), business partners, and sponsors, and may receive information about you (including publicly available information) from them.