privacy policy | Karahi Boys

This Privacy Policy explains how Karahi Boys ("Karahi Boys," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit karahiboys.com, place an order, make a reservation, sign up for our newsletter, submit feedback, apply for a franchise, or otherwise interact with us online (collectively, the "Site").

This policy applies to our corporate website and to participating franchise locations that use our online ordering, reservation, and feedback systems. Karahi Boys Franchise Corp is the responsible party for how personal information is handled through these shared systems. If a franchise location operates its own separate, local channel (for example, its own independent ordering app or website) under its own separate privacy policy, that location's policy governs that separate channel instead of this one.

We collect the following categories of information:

a) Information you provide directly

• Contact details (name, email address, phone number) submitted through our reservation, feedback, newsletter signup, or franchising inquiry forms
• Account credentials (username/email and password) if you create an online ordering account, including information used for password recovery
• Order details, including items ordered, pickup/delivery location, and delivery address where applicable
• Reservation details, including party size, date, time, and preferred location
• Franchise inquiry information, which may include business background, financial capacity, and location preferences submitted through our Franchising page
• Feedback, comments, or complaints you submit through our Feedback form
• Payment-related information you enter through our online ordering or gift card platforms (processed by third-party payment processors — see Section 4)

b) Information collected automatically

• Device and usage data such as IP address, browser type, pages visited, and referring pages, collected via cookies and similar technologies
• Approximate location, if you select or search for a nearby restaurant location
• Analytics and advertising identifiers used to measure site performance and ad campaign effectiveness (see Section 5)

c) Information from third parties

• Order and delivery information from third-party platforms such as DoorDash, Uber Eats, and Skip the Dishes, where you order through those platforms
• Information from our website and ordering platform provider, Tossdown, which hosts our site, accounts, and online ordering system
• Public information from our social media pages (Facebook, Instagram, TikTok, YouTube) if you interact with our posts or profiles

We use the information we collect to:

• Process and fulfill orders, reservations, and gift card purchases
• Create and manage your online account, including password resets
• Respond to feedback, complaints, and franchise inquiries
• Send newsletters or promotional communications, where you have signed up to receive them
• Operate, maintain, and improve the Site and our services
• Analyze site traffic and marketing campaign performance
• Detect, prevent, and address technical issues, fraud, or abuse (including CAPTCHA verification on forms)
• Comply with legal obligations

karahiboys.com uses cookies and similar technologies (such as those from our website platform provider, analytics tools, and advertising partners) to operate core site features (like your shopping cart and location selection), remember your preferences, and measure the performance of our website and ad campaigns. You can control or disable cookies through your browser settings; note that some site features, such as online ordering, may not function properly without them.

Online orders, gift cards, and related transactions are processed through third-party platforms (which may include Toast, DoorDash, Uber Eats, Skip the Dishes, and our website/ordering provider Tossdown, or their payment partners). We do not store full payment card numbers on our own servers. Your payment information is subject to the privacy policy of the applicable payment processor or ordering platform, which we encourage you to review.

We may use analytics and advertising tools (such as Google Analytics and Meta/Facebook Pixel) to understand how visitors use our Site and to measure the performance of our advertising, including social media and search advertising campaigns. These tools may collect information about your visits to this and other websites through cookies or similar technologies. You can learn more about, and opt out of, some of this tracking through your browser settings or the tools referenced above (for example, Google's Ads Settings or Meta's Ad Preferences).

We do not sell your personal information for money. Some of the analytics and advertising tools described in Section 5 (such as Google Analytics and Meta/Facebook Pixel) may fall under certain U.S. state laws' broader definition of "sharing" personal information for cross-context behavioral advertising, even though no sale takes place. If you are a California resident, you can opt out of this kind of sharing using the "Your Privacy Choices" link on our Site, or through the browser and platform tools referenced in Section 5.

We may also share information with:

• Franchise locations, to fulfill orders, reservations, or respond to feedback directed to a specific location
• Service providers who help us operate the Site, process orders, host data, send communications, or process payments (including Tossdown, Toast, and delivery/ordering platforms)
• Delivery and ordering partners (DoorDash, Uber Eats, Skip the Dishes) when you place an order through those platforms
• Professional advisors and, where relevant, prospective franchise partners, in connection with franchise applications
• Authorities or third parties where required by law, or to protect our rights, property, or safety, or that of our customers

If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm — such as bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on your credit record, or loss of property — we will, as soon as feasible:

• Notify the applicable privacy regulator, including the Office of the Privacy Commissioner of Canada where PIPEDA applies
• Notify affected individuals directly, unless direct notification is impossible, impractical, or inadvisable
• Notify any other organization that may be able to help reduce the risk of harm to affected individuals
• Take reasonable steps to investigate, contain, and remediate the breach

We keep a record of every breach of security safeguards, whether or not it meets this threshold, for at least 24 months.

We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to maintain your account, respond to inquiries, comply with legal, tax, or accounting obligations, and resolve disputes. Franchise inquiry information is retained for the duration of the application review process and as required by our records-retention practices.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain uses (such as marketing communications or, where applicable, targeted advertising).

Canada

If you are located in Canada, our collection, use, and disclosure of personal information is governed by applicable federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA). You may request access to, or correction of, your personal information by contacting us using the details in Section 12. We aim to respond to your request within 30 days. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

United States

If you are a resident of a state with its own privacy law (such as California, Virginia, Colorado, Connecticut, or Utah), you may have additional rights under that state's law, including the right to know what personal information we collect, to request deletion, and to opt out of certain sharing (see Section 6 regarding cross-context behavioral advertising). To exercise these rights, contact us using the details in Section 12. We will respond to verifiable requests within the time required by applicable law.

You can unsubscribe from marketing emails at any time using the unsubscribe link in those emails.

Our Site and services are not directed to children under 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

We use reasonable administrative and technical safeguards designed to protect personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. See Section 7 for what happens if a breach occurs.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

• Karahi Boys Franchise Corp
• 220 Wyecroft Road, Unit 48, Oakville, ON L6K 3V1
• [email protected]

We may update this Privacy Policy from time to time, including to reflect changes in our practices or applicable law. The "Effective Date" at the top of this page indicates when it was last revised. We encourage you to review this page periodically.