Privacy Policy

Haadi Biryani ("we," "us," or "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit HaadiBiryani.com, place an order, use our catering services, apply for a franchise, or interact with us in any way. We believe you have the right to know exactly what happens with your personal information. This policy is designed to be clear and transparent, written in plain language so you can make informed decisions about your data. By using our Services, you agree to the practices described in this Privacy Policy. If you have any questions or concerns about how we handle your data, please contact us using the details provided at the end of this document.

We collect different types of information depending on how you interact with us: 2.1 Information You Provide Directly When you register an account, place an order, make a catering enquiry, or contact us, you may provide: • Full name • Phone number and email address • Delivery address and location details • Payment information (processed securely by third-party gateways — we do not store card details) • Order history and preferences • Messages, feedback, or reviews you submit • Franchise application details (for franchise enquiries) • Event details (for catering bookings) 2.2 Information Collected Automatically When you visit our website, we automatically collect certain technical information, including: • IP address and approximate geographic location • Browser type, version, and operating system • Pages visited, time spent on pages, and navigation patterns • Referring website or source (how you arrived at our site) • Device type (mobile, tablet, desktop) • Cookies and similar tracking technologies (see Section 7) 2.3 Information from Third Parties We may receive information about you from third parties, including: • Payment processors (eSewa, Khalti, IME Pay) — transaction confirmations only • Social media platforms if you connect your account or interact with our social pages • Delivery partners for order tracking and logistics purposes • Analytics providers for website performance data

We use the personal information we collect for the following purposes: 3.1 To Provide Our Services • Process and fulfill your food orders • Arrange and manage catering bookings • Communicate order status, updates, and delivery notifications • Process payments and issue receipts • Manage your user account 3.2 To Improve Our Services • Analyze ordering patterns and popular menu items • Monitor website performance and fix technical issues • Conduct customer satisfaction surveys • Develop new products, services, or menu items based on preferences 3.3 To Communicate With You • Send order confirmations and delivery updates via SMS or email • Respond to your enquiries, complaints, or feedback • Send promotional offers, discounts, and news (only with your consent) • Notify you of important changes to our services or policies 3.4 For Legal & Security Purposes • Comply with applicable laws and regulations of Nepal • Detect and prevent fraud, abuse, or unauthorized access • Resolve disputes and enforce our Terms and Conditions • Maintain records required by tax and financial regulations 3.5 For Franchise Operations • Evaluate franchise applications and communicate with applicants • Manage franchise relationships and compliance • Share operational data with franchise partners as agreed

We process your personal data only when we have a valid legal basis to do so. The legal bases we rely on include: • Contract Performance: Processing is necessary to fulfill your order or provide a service you have requested. • Legitimate Interests: We may process your data to improve our services, prevent fraud, and operate our business effectively, provided such interests do not override your privacy rights. • Consent: For marketing communications and non-essential cookies, we rely on your explicit consent. You may withdraw consent at any time. • Legal Obligation: We process data where required to comply with applicable Nepalese laws, tax regulations, or court orders.

We do not sell your personal data. We may share your information with trusted third parties only in the following circumstances: 5.1 Service Providers We share data with carefully selected third-party service providers who assist us in operating our business, including: • Payment processors (eSewa, Khalti, IME Pay) — to complete transactions • Delivery partners — to fulfill home delivery orders (name, address, phone number) • SMS and email service providers — to send order notifications • Website hosting and cloud storage providers • Analytics platforms — for anonymized website usage insights All service providers are contractually required to protect your data and use it only for the purposes we specify. 5.2 Franchise Partners If you place an order through or interact with a Haadi Biryani franchise outlet, relevant order and customer data may be shared with that franchise partner to fulfill your order. Franchise partners are bound by data protection obligations under their Franchise Agreement. 5.3 Legal Requirements We may disclose your information if required to do so by law, court order, government authority, or to protect the rights, property, or safety of Haadi Biryani, our customers, or others. 5.4 Business Transfers In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting obligations. The specific retention periods we follow are: • Order data and transaction records: Retained for 5 years to comply with Nepalese tax and financial regulations. • Account information: Retained for the duration of your account plus 2 years after account closure. • Customer communications and complaints: Retained for 3 years. • Marketing consent records: Retained for the period during which consent is active, plus 3 years after withdrawal. • Catering booking records: Retained for 5 years. • Franchise application data: Retained for 3 years regardless of application outcome. When your data is no longer required, we securely delete or anonymize it so it can no longer be associated with you.

7.1 What Are Cookies? Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, maintain your session, and understand how users interact with the site. 7.2 Types of Cookies We Use • Essential Cookies: Required for the website to function (e.g., maintaining your shopping cart and login session). These cannot be disabled. • Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics). Data is anonymized and aggregated. • Preference Cookies: Remember your settings and preferences (e.g., saved delivery addresses, language preferences). • Marketing Cookies: Used to show you relevant promotions and track the effectiveness of our advertising campaigns. Only placed with your consent. 7.3 Managing Cookies You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a cookie is set. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit the help section of your browser or www.allaboutcookies.org.

Depending on applicable laws, you may have the following rights regarding your personal data: • Right to Access: You may request a copy of the personal data we hold about you. • Right to Rectification: You may request correction of inaccurate or incomplete data. • Right to Erasure: You may request deletion of your personal data, subject to legal obligations that require us to retain certain records. • Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances. • Right to Data Portability: You may request your data in a structured, machine-readable format. • Right to Object: You may object to processing based on legitimate interests, including direct marketing. • Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. To exercise any of these rights, please contact us using the details in Section 13. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

We may send you promotional emails, SMS messages, or WhatsApp notifications about special offers, new menu items, seasonal promotions, and events — but only with your prior consent. You can opt out of marketing communications at any time by: • Clicking the "Unsubscribe" link in any marketing email. • Replying "STOP" to any promotional SMS. • Contacting us directly at info@haadibiryani.com. Please note that even if you opt out of marketing communications, we will still send you transactional messages related to your orders (order confirmation, delivery updates, receipts), as these are necessary for service delivery.

Our Services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately so we can delete the information. Users between 13 and 18 years of age may use our Services only with the knowledge and supervision of a parent or legal guardian. By allowing a minor to use our Services, you as the parent or guardian accept these Terms and this Privacy Policy on their behalf.

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it from unauthorized access, alteration, disclosure, or destruction. Our security measures include: • SSL/TLS encryption for all data transmitted between your browser and our website. • Secure, access-controlled servers for data storage. • Regular security assessments and vulnerability testing. • Limited employee access to personal data on a need-to-know basis. • Staff training on data protection and privacy best practices. • Secure third-party payment processing — we do not store card or wallet credentials. While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to addressing any security incidents promptly and transparently. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant authorities in accordance with applicable laws.

Your personal data is primarily stored and processed in Nepal. However, some of our third-party service providers (such as analytics platforms or cloud hosting services) may process data in other countries. When this occurs, we ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy. By using our Services, you consent to the transfer of your information to countries outside Nepal where our service providers operate, provided that such transfers are made with adequate protections in place.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact our Privacy Team: Haadi Biryani — Privacy Team Website: HaadiBiryani.com Location: Kathmandu, Nepal Email: privacy@haadibiryani.com General Enquiries: info@haadibiryani.com We are committed to resolving all privacy concerns and will respond to your enquiry within 30 business days.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make significant changes, we will: • Update the "Last Updated" date at the top of this policy. • Post a notice on our website homepage. • Send an email notification to registered users where required by law. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our Services after any updates constitutes your acceptance of the revised policy. Your trust matters to us. Haadi Biryani is committed to keeping your personal information safe, secure, and used only as described in this policy. © 2026 Haadi Biryani. All Rights Reserved.