P:********.*:**A**.*** P:********.* Effective Date: January 1, 2020

Employee Privacy Policy

The California Consumer Privacy Act (CCPA) was passed in June 2018. Effective January 1, 2020, the CCPA gives job applicants and actual employees the right to know the categories of personal information Cohn Restaurant Group, Inc., a California corporation (“CRG”), may collect from them and how such information can be used. We adopted this Employee Privacy Policy

(“Privacy Policy”) to comply with the CCPA, to supplement our Employee Handbook (which has or will be provided to you if you commence employment with us), and to notify you of our information gathering and dissemination practices during your potential or actual employment with CRG (“Employment”). References in this Privacy Policy to “we,” “ us,” or “our” mean CRG (and its successors, assigns, and affiliated entities) and references to “you” and “your” mean you the actual or prospective employee.

Information We Collect and Use. When applying for Employment, onboarding as an employee, or during your performance of services relating to your Employment, we may collect the following information from you and use it for the purposes described in this Privacy Policy and our written policies, including without limitation the Employee Handbook:

• Identifiers including real name, alias, postal address, unique personal identifier, online identifier, internet protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers (collectively, the “PII”). We use your PII for employee-related purposes including without limitation to: contact you when necessary regarding your obligations, CRG events, and other notices; send you information about CRG, its products or services, and information you’ve requested; process your payroll, benefits, taxes, and expenses; create work schedules; and share your information, as necessary, with our human resources service providers, payroll processors, benefits vendors, insurance providers, accountants, legal counsel, and other third parties in connection to the general operations of CRG and its contractual and statutory obligations as your potential or actual employer. You may be asked to provide additional PII, including without limitation your citizenship information, household information (e.g., the names, birthdates, sex and age of your spouse, children and other beneficiaries), vehicle information (e.g., the model, year and license number), emergency contact information, medical information, benefit elections, and your work schedule availability. If you provide us with personally identifying information of individuals other than yourself, you represent that you are authorized and received consent from such third party to provide us with such information and to use it as disclosed herein.

• Characteristics of protected classifications under California or federal law. This information will be used for our record keeping purposes and to access and improve our employee policies, operations, and outreach.

• Biometric information. You may need to provide us with information regarding your height, weight, shirt, pants, or shoe size to receive proper uniform (if applicable) to be worn during your Employment. We may also make a record of your behavior, attitudes, and abilities as it relates to your Employment to decide whether to offer you a job or promotion or provide you with performance reviews.

• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with an internet website, application, or advertisement. We may log the name of your Internet service provider, IP address, or use “cookie” technology to store your preferences, browsing history, and record session information as you log into and use CRG employee software, electronic mail systems, voice mail systems, computer systems, websites or when using CRG’s computers, tablets, and other equipment (collectively, the “Technology Resources”). All messages sent and received, including personal messages and all data and information stored on Technology Resources are CRG property regardless of the content. CRG may monitor and store internet, electronic files, messages, mail, other digital archives, and the use of electronic communications as necessary to ensure that no misuse or violation of CRG policy or any law occurs. Employees should have NO expectation of privacy in using any Technology Resources, or any information or communications related to business matters stored on personal equipment. Employees who delete or erase information or messages should not assume that such information or messages are confidential. We may use your information collected through its Technology Resources to customize and tailor your experience on our Technology Resources and improve our employee policies, operations, and outreach.

• Audio, electronic, visual, thermal, olfactory, or similar information. As further discussed in our Employee Handbook, we may video record you during your shifts or when you are physically at one of CRG’s restaurants or offices. Additionally, if you are at a CRG sponsored event where photos or video recordings are taken, we may use images or recordings of you at such events for our promotional and marketing purposes.

P:01332622.4:86A09.002 P:01332622.3 Effective Date: January 1, 2020

• Professional or employment-related information and educational information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (FERPA). We may use this information to assess whether to offer you Employment or promote your position or expand your responsibilities as an employee of CRG. Other Uses. We also collect information as we deem necessary to track/verify compliance with federal, state, and local laws and for our general record-keeping purposes. We may disclose your information in response to a court order, when we believe we must do so by law and/or whenever we deem it appropriate or necessary to inform law enforcement authorities. Additionally, we reserve the right to share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. We will not provide you with notice before disclosure in such cases.

Retention and Privacy Policy Changes. CRG will retain your information for as long as is necessary for the purposes set out in this Privacy Policy or to operate its business and comply with our legal obligations, resolve disputes, enforce our agreements, and our written policies, including without limitation our Employee Handbook. CRG may change its Privacy Policy from time to time, and in CRG’s sole discretion. When we make changes, we will revise the “Last Updated Date” of this Privacy Policy and provide you with a copy.

For More Information. If you have questions or concerns regarding this Privacy Policy or use of your information, please contact us at ad2fhv@r.postjobfree.com or by mail at: Cohn Restaurant Group

2225 Hancock Street

San Diego, CA 92110