BORA BORA FRANCHISING INC. (DBA BORA BORA SMOOTHIE CAFE) — PRIVACY POLICY

Effective Date: September 12, 2025

Bora Bora Franchising Inc. ("Bora Bora," "we," "us," or "our") is committed to protecting the privacy of customers and users of our services (the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect Personal Information when you interact with us through our website, mobile application, Bora Bora-branded social channels, in our restaurants operated by franchisees, during promotions, when you join our loyalty program, or otherwise interact with us (collectively, the "Services").

By using any of our Services or providing Personal Information to us, you agree to the practices described in this Privacy Policy. If you are a resident of California or Virginia, you may have additional rights; see Section 12.

1. Scope & Franchise Model

Bora Bora Franchising Inc. is the franchisor and brand owner of the Bora Bora Smoothie Cafe system. Each Bora Bora Smoothie Cafe is independently owned and operated by a franchisee. Franchisees are separate legal entities and are solely responsible for their own operations, legal compliance, and data practices. While we encourage franchisees to align with this Privacy Policy, they may maintain their own privacy practices. For information about how a specific restaurant handles Personal Information, please contact that restaurant directly.

2. Information We Collect

We collect Personal Information you provide directly and information collected automatically when you use the Services. "Personal Information" means information that identifies or reasonably can be associated with an identifiable individual.

A. Information You Provide. Examples include: name, postal address, email address, phone number, birthdate (for birthday offers), payment information (collected securely by payment processors), account credentials, loyalty account details (e.g., location preferences, rewards history), job application materials, survey responses, and any other information you choose to provide.

B. Transaction and Order Information. Order history and transaction details, including items ordered, date/time, location, and fulfillment details.

C. Automatic/Technical Information. IP address, device type, browser, pages visited, cookies and similar technologies, approximate geolocation (if you enable location services), and usage data.

D. Third-Party Sources. We may receive Personal Information from franchisees, service providers (e.g., Toast POS), delivery platforms (e.g., Uber Eats, DoorDash, Grubhub), advertising partners, analytics providers, and social networks.

3. How We Use Personal Information

We use Personal Information for business and commercial purposes including to:

• Provide, operate, and improve the Services (fulfill orders, manage accounts, process payments);
• Operate our loyalty program (Bora Rewards) and process rewards;
• Communicate with you about orders, accounts, promotions, and service messages;
• Personalize marketing and promotional offers;
• Administer contests, surveys, and sweepstakes;
• Detect, prevent, and respond to fraud or security incidents;
• Provide customer service and technical support;
• Conduct analytics and business reporting; and
• Comply with legal obligations or to exercise or defend legal claims.

We do not use Personal Information in ways incompatible with the context in which it was collected without giving additional notice.

4. Loyalty Program - Bora Rewards

When you enroll in Bora Rewards, you earn 1 point for every $1 spent. 100 points = $5 off. Program mechanics include the following promotional bonuses (which may vary by location or promotion):

• Sign-up bonus: Guests receive 50 points upon signing up (equivalent to $2.50).
• Birthday bonus: Guests unlock $5 OFF during their birth month (birthdate required).
• Dining option bonus: Guests earn 2x points on takeout orders placed through the online ordering website.
• Day & time bonus: Guests earn 2x points Monday through Thursday.

Redemption rules, point expiration, and other program terms (including variations by location or franchisee) are governed by the Bora Rewards terms and any third-party platform used to administer the program (for example, Toast-powered loyalty services). Points and rewards have no cash value except as expressly stated in the program rules.

5. Disclosure of Personal Information

We may disclose Personal Information to:

• Our affiliates and franchisees (for order fulfillment, loyalty administration, and marketing);
• Service providers who perform services on our behalf (e.g., payment processors, POS providers such as Toast, ordering and delivery platforms such as Uber Eats, DoorDash, Grubhub, analytics and marketing platforms, background-check and payroll providers);
• Social media and advertising partners for targeted advertising (subject to your choices and applicable law);
• Law enforcement, regulators, or other third parties when required by law or to protect rights or safety; and
• A third party in connection with a merger, acquisition, sale, or reorganization.

We require service providers to use Personal Information only as needed to provide services to us and not for independent purposes.

6. Cookies & Tracking Technologies

We and third parties use cookies, web beacons, local storage, and similar technologies to collect technical and usage information. Non-essential cookies (analytics, advertising, targeting) are set only after you provide consent via our cookie consent manager (CMP). Cookies may be essential for security and site functionality, analytics, and targeted advertising. You can manage cookie settings through your browser or device; disabling cookies may limit functionality.

Opt-out resources for behavioral advertising:
– Network Advertising Initiative (NAI): https://networkadvertising.org/choices/
– Digital Advertising Alliance (DAA): https://www.aboutads.info/choices/

We honor recognized browser privacy preference signals (e.g., Global Privacy Control) to the extent required by law.

7. Children's Privacy

Our Services are not intended for individuals under 16. We do not knowingly collect Personal Information from children under 16. If we learn we collected Personal Information from someone under 16, we will delete it as required by law. Parents or guardians who believe we have collected Personal Information about their child should contact us at the channels in Section 14.

8. Data Retention & Security

We retain Personal Information for as long as necessary to provide Services, for legitimate business purposes, to satisfy legal obligations, and to resolve disputes. Unless otherwise required, our default retention periods are:

• Orders/transactional data: 7 years
• Account/loyalty data: as long as the account is active plus 3 years after account termination
• Job applications (non-hired): 2 years
• Security logs/audit records: 1-3 years

We implement reasonable administrative, technical, and physical safeguards to protect Personal Information. No security measure is perfect; we will notify affected individuals and regulators as required by law in case of a qualifying data breach.

9. Your Choices & How to Exercise Them

Contact & Requests:
– Email: Hi@boraborausa.com
– Privacy Web Form / Policy URL: https://boraborausa.com/privacy/
– Mail: Bora Bora Franchising Inc., Attn: Privacy, 3 Parklane Blvd Ste 700 West, Dearborn, MI 48126

To exercise access, deletion, correction, or opt-out rights (including rights under California or Virginia privacy laws), submit a request via the privacy web form or the email above. We will verify requests as required by law and may require additional information to confirm identity or authority.

Marketing Opt-Outs: Click "unsubscribe" in marketing emails or contact Hi@boraborausa.com. Opting out of marketing will not prevent transactional messages (e.g., order confirmations).

Cookies & Targeted Ads: Manage cookies through your browser/device and opt out of cross-context behavioral advertising through industry tools (NAI/DAA) or by contacting us.

Privacy Preference Signals: We will honor recognized browser privacy preference signals such as Global Privacy Control to the extent required by applicable law.

10. Third-Party Sites & Links

Our Services may link to or integrate with third-party services and platforms (for example, Toast, Uber Eats, DoorDash, Grubhub, payment processors, social networks, and advertising/analytics providers). Each third party has its own privacy practices and terms of service; we are not responsible for their actions. Please review third-party privacy policies before sharing Personal Information.

11. International Transfers

If Personal Information is transferred outside the country where it was collected, we will protect it in accordance with this Privacy Policy and applicable law. Where required, we will rely on appropriate transfer mechanisms or contractual safeguards.

12. State-Specific Notices, Rights & Choices

A. California Residents

California residents may have rights under the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA): Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of sharing for targeted advertising, and Right to Non-Discrimination. We do not sell Personal Information as defined under California law. To exercise California privacy rights visit our privacy web form or email Hi@boraborausa.com.

B. Virginia Residents

Virginia residents may have rights under the Virginia Consumer Data Protection Act (VCDPA): Right to Access, Right to Correction, Right to Deletion, Right to Portability, and Right to Opt-Out of targeted advertising and certain profiling. To exercise Virginia rights visit our privacy web form or email Hi@boraborausa.com.

For other state-specific rights, see our Privacy Web Form for instructions.

13. Employment Applicants

If you apply for a job with Bora Bora corporate support or corporate-owned operations, we collect and use the information you submit to evaluate your candidacy. If you apply for a position at a franchisee-operated Bora Bora Smoothie Cafe location, your application and related information will be forwarded directly to the applicable franchisee. Franchisees are independent employers who make their own hiring decisions and are solely responsible for their own employment practices, policies, and compliance with applicable labor and employment laws. Bora Bora Franchising Inc. does not participate in, control, or oversee franchisee hiring decisions.

14. How to Contact Us

For privacy questions, requests, or concerns:

• Email: Hi@boraborausa.com
• Privacy Web Form / Policy URL:<https://boraborausa.com/privacy/
• Mail: Bora Bora Franchising Inc., Attn: Privacy - 3 Parklane Blvd Ste 700 West, Dearborn, MI 48126

15. Changes to This Privacy Policy

We may update this Privacy Policy. We will post the revised policy on our website and update the "Effective Date" above. Continued use of the Services after changes are posted constitutes acceptance of the revised policy.

16. Disclaimer

This Privacy Policy is a template drafted to reflect common practices for franchise restaurant groups and is provided for convenience. It does not constitute legal advice. Have this policy reviewed and customized by your counsel (and encourage franchisees to adopt compatible policies) to ensure compliance with federal, state, and local laws.