PANDA RESTAURANT GROUP, INC. PRIVACY POLICY

LAST UPDATED: August 9, 2023

The following statement discloses the privacy practices of Panda Restaurant Group, Inc., and its affiliates, subsidiaries and related entities including, but not limited to Panda Express, Panda Inn, Wasabi, Uncle Tetsu, Yakiya, and Hibachi San locations owned and operated by us (collectively, “Panda” or “we” or “us”). We respect your privacy and are committed to protecting it through our compliance with this policy. This policy describes the types of information we may collect from you or that you may provide through various channels such as our websites, mobile apps, visiting our stores and other interactions (collectively “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that information. By using our Services, you agree to this Privacy Policy, the Terms and Conditions for Services and all applicable laws governing its use. Be sure to check this page periodically for updates, as your continued use of the Services signifies your acceptance of any changed terms. Panda reserves the right to revise this Privacy Policy at any time and without notice. Any such revision will be effective immediately upon its posting on this website. If you are a California resident, please click here to review the privacy notice applicable to you.

INFORMATION COLLECTION

We collect several types of information from and about users of our Services. Information collected may include contact information, demographic information and opinions, including information by which you may be personally identified, such as name, postal address, e-mail address, user ID, telephone number, payment information or any other identifier by which you may be contacted online or offline ("personal information"). This includes information provided when you enter a contest or promotion sponsored by us, when you report a problem with our Services, if you contact us or if you respond to surveys that we might ask you to complete for research purposes. Some information collected is about you but individually does not identify you, such as your age, occupation or place of residence and about your internet connection, the equipment you use to access our Services, and usage details. We collect this information directly from you when you provide it to us, automatically as you navigate through the website or from third parties, for example, our business partners.

Information You Give

The information we collect on or through our Services may include information that you provide by filling in forms on our website, participating in surveys, sweepstakes, or other programs. You may provide financial information if you visit our restaurants.

You may also permit us to access information directly from your device, such as information in the “contacts list". If you submit someone else’s personal information to us (e.g., someone else’s contact information), you represent that you are authorized to provide this information to us.

In the "Careers" section of our websites we have an employment application. The completion of this form is voluntary, and all information collected is routed to Human Resources in the form of an e-mail or hiring/recruiting website. Information you submit online through this website may be shared by and among Panda and its subsidiaries and affiliates. We protect the confidentiality of such information sent to Panda.

Information Collected Automatically

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including but not limited to details of your visits to our website, like traffic data, location data, logs, and other communication data and the resources that you access and use on the website. We may collect personal information via your cell phone, smartphone, and tablet such as your internet connection, including your IP address, operating system, and browser type. If you use any location-enabled products, you may be sending us location information. Panda does not store or use this information other than to provide the service you requested. For example, a mobile product may use GPS data to find a nearby restaurant you requested. Location-enabled features are opt-in and you have control over your participation and can turn these services off at any time.

The technologies we use for this automatic data collection may include:

• Cookies. A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website.


• Flash Cookies. Certain features of our website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our website. Flash cookies are not managed by the same browser settings as are used for browser cookies.


• Web Beacons. Pages of the website may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Information Collected from Third Parties

Panda uses a variety of new technologies and social media options to communicate and interact with you. We do occasionally provide links to third party websites on our websites. These websites and mobile applications include popular social networking and media sites, such as Instagram, Twitter and Facebook. We add these links to provide further information and enjoyment of your web experience from our websites. Panda tries to thoroughly review the websites we link to; however, we are not responsible and have no control over the content, privacy practices, policies or information collection practices of those pages. These websites may use their own cookies or solicit personally identifiable information from you. Panda does not capture or store your login information or other personal information for these services, however session info or cookies may be stored.

You may opt-out of the use of the Google Analytics advertising features at https://tools.google.com/dlpage/gaoptout. For more information regarding how Google collects, uses and shares your information please visit http://www.google.com/policies/privacy/partners/.

We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

USE OF INFORMATION

WWe will not sell the information to any unaffiliated third parties in any way not described in this Privacy Policy, or authorize any of our third party partners to sell any such personal information. We only gather personal information as disclosed in this policy. We do not explicitly authorize third parties unaffiliated with Panda to make independent use of your information for their own purposes, such as for direct marketing.

We may at any time administer surveys, hold contests, or supply special offers to our database of users who have elected to let us contact them by e-mail, text messaging, direct messaging, or through social media. Participation in any of these on-line programs is voluntary, and you will always have the option to not supply information and/or opt out of programs. Information may be used by third parties working on our behalf to respond to a request or contact a guest if they have won a contest, send special offers, or help us to determine the likes and preferences of consumers to better enhance our food, restaurants, overall customer experience, websites, and marketing. We do not make any of the information collected available to third parties other than solely on our behalf.

The information collected may be combined with other information collected about you and may be used to help us better understand and serve our customers including, without limitation to, responding to your requests for information and/or services, providing you with information about new products or services, enhancing our customers’ and website users’ experiences in our restaurant locations or on this website and conducting research and analysis and to otherwise measure the effectiveness of Panda’s online and offline marketing efforts.

We may use the information we collect about you to:

• Process your purchases of or requests for our products and services;
• Communicate with you about orders, purchases, accounts, services, contests, and sweepstakes;
• Respond to your customer service inquiries and requests for information;
• Inform you about our brands, products, events, or other promotional purposes;
• Maintain, improve, and analyze our websites, mobile applications, ads, and the products and services we offer;
• Detect, prevent, or investigate security breaches, fraud or other crime;
• Maintain appropriate records for internal administrative purposes;
• Deliver gift cards in accordance with your instructions; and/or;
• Comply with applicable law.

SHARING OF INFORMATION

We may share your information between and among Panda, its subsidiaries, franchisees, licensees, lenders, affiliated companies, investors and/or third party service providers. Panda may share your information with vendors who provide services to us, such as fulfilling orders, managing promotions, contests, and sweepstakes, and carrying out research and analysis. We may share your information for marketing purposes. If we decide to sell or transfer all or part of our business, we may share your information to anyone involved in the sale or transfer. Panda may share your information when it does not directly identify you. For example, we may share anonymous, aggregated statistics about your use of our online services. We may share your information as necessary if required by law, to bring or defend legal claims, or to protect the rights, interests, safety and security of our organization, our employees or partners, or our customers.

AGE RESTRICTIONS

We love having your children visit our websites with you however, child privacy law states you cannot provide us with personal information if you are under the age of 13. If you do provide us with personal information, you represent that you are at least 13 years old. We ask that parents register any Panda Cards purchased for their children in the name of the parent or guardian. We do not knowingly request, solicit or collect personal information from any person we know to be under the age of 13. In the event that we receive actual knowledge that we have collected or received personal information from anyone under the age of 13, we will immediately delete that information from our database as soon as practicable. If a parent or guardian becomes aware that his or her child has provided personally identifiable information or otherwise made posts to this website, the parent or guardian should contact us so that we can delete such information.

CONTROLLING YOUR PERSONAL INFORMATION

We will use reasonable efforts to keep your personal information private except as otherwise provided in this Privacy Policy. We will not share the personal information with any unaffiliated third parties, unless such disclosure is necessary to (a) comply with a court order or other legal process, (b) protect your rights or our property; or (c) enforce the Terms and Conditions for Services of this website. In some jurisdictions, you may be entitled to request access to, correct or delete any personal information that you have provided to us. In some jurisdictions, you can control your personal data that Panda has obtained, and exercise your data protection rights, by contacting Panda at the following link: Here. Although we take reasonable measures to safeguard against unauthorized disclosures of personal information, we cannot assure you that personally identifiable information that we collect will only be disclosed in a manner that is consistent with this Privacy Policy.

DO-NOT-TRACK SIGNALS

Our website does not respond to do-not-track signals, except in the context of Global Privacy Control (“GPC”).

SECURITY

Protecting your personal information is important to us. We maintain administrative, technical, and physical safeguards designed to help protect against unauthorized use, disclosure, alteration, or destruction of the personal information we collect on our websites. However, no data security measures can guarantee 100 percent against compromise.

ADDITIONAL INFORMATION FOR CALIFORNIA CONSUMERS

Under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) (collectively, "California Privacy Law"), we are required to provide specific disclosures about how we use and disclose your personal information (“consumers” in this section). This section covers how we have collected, used, disclosed and otherwise processed your personal information over the past 12 months, as well as additional rights you may have with respect to your personal information ("California Personal Information"). This section does not reflect our processing of California Personal Information where an exception under California law applies.

Categories of Information We May Collect and Process

Consistent with the “Information Collection” section above, we may collect and process the following categories of California Personal Information:

• Identifiers, such as name, delivery address, e-mail address, user ID, telephone number, and IP address.
• Categories of personal information described in subdivision (e) of Section 1798.80, in addition to those already listed, such as payment information, including credit or debit card number.
• Commercial information, including records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, or application.
• Geolocation data, such as when you use your Panda app to find a nearby restaurant.
• Audio, electronic, visual, or similar information, (except that we do not sell this information). For example, if you contact our call center, we may retain a copy of that call recording. Electronic information in the form of internet or other electronic network activity information as described above. Additionally, when you visit our restaurants, we may capture video information via CCTV cameras that help us monitor restaurant safety; as noted, typically, such audio or CCTV recordings are not associated with user accounts.
• Inferences, including inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
• Other information, in addition to those already listed, such as birthday and location.

Certain California Personal Information that Panda collects about you may be considered Sensitive Personal Information within the meaning of California Privacy Law, including: credit card information (for billing and transactional purposes in connection with providing products and services) and precise geolocation information. Panda only uses and discloses Sensitive Personal Information as necessary in connection with the performance of services and the provision of goods, compliance with federal, state, or local laws, and as otherwise permitted by California Privacy Law.

Sources of California Personal Information

Panda generally sources the categories of California Personal Information identified above directly from you (for instance, when you provide information as part of a business transaction or otherwise), third party reference agencies, distributors and intermediaries, data analytics providers, and social media networks.

Purposes

We use California Personal Information for the business purposes described below including:

• Maintaining or servicing accounts;
• Responding to customer service inquiries and requests;
• Processing purchases, payments and transactions;
• Verifying customer information;
• Maintaining, improving, upgrading, and enhancing our websites, mobile apps, products and services;
• Providing our food, products, goods, information and services;
• Detecting, preventing and investigating security incidents, data breaches, fraud, or other illegal activity;
• Internal administrative purposes;
• Delivering gift cards; and
• Complying with applicable law.

We use California Personal Information for the commercial purposes described below including:

• Advertising or marketing;
• Market research and competitor analysis;
• Counting ad impressions to unique visitors;
• Verifying positioning and quality of ad impressions;
• To display personalized advertising when you visit our websites or a third party website;
• To contact you with special offers and other information we believe will be of interest to you;
• To invite you to participate in surveys and provide feedback to us;
• To better understand your needs and interests; and
• To improve our marketing and promotional efforts.

Disclosure of California Personal Information to Third Parties

We may disclose the categories of California Personal Information described above for the business purposes described above to:

• Process consumer transactions;
• Third party service providers that perform data processing activities on our behalf, and subject to appropriate privacy and security obligations;
• Government and other authorities as required by law;
• Potential purchasers and other parties in connection with the sale, purchase or merger of a business; and
• Others to the extent necessary to comply with applicable law and as otherwise permitted under California Privacy Law.

We may disclose Identifiers, Internet or other electronic network activity information, and Geolocation data for the commercial purposes described above to:

• Third party service providers; and
• Social media and ad networks.

YOUR CALIFORNIA PRIVACY RIGHTS

Subject to certain exceptions detailed in the California Privacy Law, as a California resident, you have the right to: (i) know/request access to your California Personal information that we collect and process about you, including specific pieces of California Personal Information that we have collected about you; (ii) request deletion of your California Personal Information; (iii) request correction of inaccurate California Personal Information; (iv)request that we transfer your California Personal Information to another entity to the extent technically feasible, in a structured, commonly used, machine-readable format; (vi) request information about the California Personal Information about you that we have disclosed for a business purpose and the categories of persons to whom it was disclosed for a business purpose; and (vii) request information about the California Personal Information about you that we have "sold" or "shared" (as such terms are defined under California Privacy Law) and the categories of third parties to whom the California Personal Information was sold or shared.

Exercising Your Rights

If you are a California resident and wish to request the exercise of these rights as detailed above or have questions regarding the California Personal Information collected or shared with third parties, you may do so by:

• Clicking here and submitting your request online by using our Privacy Rights Form; or
• Calling us at (800) 877-8988 (toll free).

We will respond within the timeframe required by law. Panda may apply any exceptions or other conditions available under law when responding to access, correction, deletion, or other requests. Panda will generally fulfill requests for access, correction, and deletion within 45 days of receiving a valid verified request. Panda may extend the respond time by another 45 days by notifying the individual of the time extension.

Do-Not-Sell and Limit the Use

California consumers have the right to opt-out of our “sale” or “sharing” of their California Personal Information when California Personal Information is shared with a third party for a purpose that is not a “business purpose” as set out under applicable law. To exercise your opt-out rights, click here and submit your request using the Privacy Rights Form. We do not “sell” California Personal Information about consumers that we know are younger than 16 years old without opt-in consent. Finally, California consumers also have the right to "limit the use" of their sensitive personal information. Panda only collects, uses, and discloses your sensitive personal information to provide services to you, therefore Panda is not required to provide this link.

In addition, we have configured our cookie management tool to honor opt-out preference signals sent by Global Privacy Control ("GPC") within the browser. Due to technical limitations, the GPC signal is only honored within the particular browser. Beyond GPC, we do not currently respond to web browser “do not track” signals or other mechanisms that indicate your preference for not having information collected over time and across different Web sites or digital apps following your visit to one of our Sites.

Authorized Agents

To the extent that you elect to designate an authorized agent to make a request on your behalf, they must provide appropriate documentation including written signed permission from you, proof of your identity, and verification of their identity; or a valid, designated power of attorney as defined under the California Probate Code.

Right to Non-Discrimination

We will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon your exercising your rights under applicable law.

Notice of Financial Incentive

The Panda Rewards Program (“Rewards Program”) is a rewards program that allows registered members to earn Panda Points from Qualifying Purchases and can be applied towards the purchase of eligible food and drink once you have earned the required number of Panda Points to do so. We may at any time hold contests or provide special offers ("Programs") to users in our database who have elected to let us contact them by e-mail, text messaging, direct messaging, or through social media. Participation is voluntary, and you always have the option to not supply information and/or to opt out. Information collected may include contact information, demographic information and opinions. Information may be used by third parties working on our behalf to contact you if you have won a contest, send special offers, or help us to determine the likes and preferences of consumers to better enhance our food, restaurants, overall customer experience, websites, and marketing. Because our Programs involve the collection of personally identifiable information, they might be interpreted as a "financial incentive" program under California law. Panda is unable to assign an independent monetary value to the personal information we collect in connection with our Programs due to many factors, including, without limitation (a) the number of dollars spent and points accumulated, (b) the rewards redeemed, (c) the frequency in which a consumer uses any rewards, (d) whether or not participants collect points, (e) motivating factors of any purchase, or (f) level of engagement of any Program participants. In general, however, Panda estimates in good faith that the value of your personal information to us is less than the value of the perks provided in the Program less other factors, including, but not limited to, the expense related to offering those products, services, and benefits to Program participants. You may withdraw from participating in a Program at any time by contacting us using the designated method set forth in the applicable Program terms and conditions. To the extent Panda engages in financial incentives in connection with Programs, we will provide information describing the material terms of the program and will obtain opt-in consent from users before they participate. Users can opt-out from a program at any time by following the instructions provided in such terms.

Data Retention

We keep your California Personal Information for as long as needed or permitted according to the purpose(s) for which it was obtained. The criteria used to determine our retention periods include (i) for as long as we have an ongoing relationship with you; (ii) as required by a legal obligation to which we are subject to; or (iii) as advisable considering our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations). We may remove California Personal Information for inactive accounts from our database, subject to any applicable legal or regulatory obligations. Furthermore, we may delete California Personal Information from our database at any time and without providing any reason.

Shine the Light Law

California residents are entitled once per year to request and obtain certain information regarding our disclosure, if any, of your personally identifiable information to third parties for their direct marketing purposes during the immediately prior calendar year. To make such a request, please send an email to guestcare@pandarg.com with the subject line “Shine the Light Request” and your full name, email address, and postal address in your message. In response to your request, we will provide you with a notice describing the cost-free means to opt-out of our sharing your personally identifiable information with third parties with whom we do not share the same brand name, if the third party will use it for their direct marketing purposes.

Contact Us

If you have a privacy concern, complaint, or question about our Privacy Policy, please contact us to change how we use your information. You may contact us via Panda Express Guest Care at guestcare@pandarg.com, via our toll-free number: (800) 877-8988 or by clicking here. We will respond to questions or concerns within 10 days.