Effective Date: October 2026

This Privacy Policy explains what information Great Harvest Franchising, Inc. (“Great Harvest”) collects on www.greatharvest.com and the Great Harvest mobile application (collectively, the “Site”), why we collect it, how we use it, and when we share this information with third parties. This Privacy Policy applies solely to information collected by Great Harvest Franchising on this Site and through use of the Great Harvest mobile application, and does not apply to information collected offline, including, but not limited to, information you may provide over the phone to or in person at a Great Harvest bakery or bakery cafe location owned and operated by a Great Harvest franchisee.

Please read this Privacy Policy to carefully understand our policies regarding the collection, treatment, and use of your personal information. If you do not agree with our policies and practices, you should not use our Site. By accessing or using the Site, you accept and agree to be bound and abide by this Privacy Policy and our Terms of Use. Because we may change our Privacy Policy from time to time, we urge you to review this policy each time you visit our Site. By continuing to use the Site, you agree to be bound by such changes.

CONDITIONS OF USE

If you choose to use Great Harvest services, including but not limited to the Great Harvest Rewards Program, your use and any dispute over your privacy is subject to this Privacy Policy, our Site Terms of Use, and the Terms and Conditions for the Great Harvest Rewards Program available here.

INFORMATION WE COLLECT

Great Harvest may collect some personal information that personally identifies you in particular, or relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). We may collect personally identifiable information, such as your first and last name, mailing address, email address, birthdate, and telephone number, when you provide it voluntarily.

We may also collect information:

• About you, but does not individually identify you, such as demographic data.
• About your internet connection, the devices you use to access our Site, and usage details, such as the pages of the Site you visit, the time of your visit, and the time spent on those pages.
• About your location, when permitted by using the app or searching for a Great Harvest location near you.
• About your payment information when you place an order on the Site.

If you are an applicant for a Great Harvest franchise and complete a franchisee application, we will collect financial information, business ownership information, occupation, and other details that you voluntarily provide through the application process. If you are a user of our internal training site, MyGH, we also collect your hire date, birthday, and optional “About Me” information you choose to add to your profile.

HOW WE COLLECT INFORMATION

We collect this information directly from you or as you automatically navigate through the Site. For example, we collect information directly from you when you sign up for a rewards account, place an order online, or contact us by email or any other method. Personal information you provide to us directly may include: First and last name, email address, phone number, postal address, username, and password.

We may also ask you for your information when you enter a contest or promotion sponsored by us and when you report a problem with our Site.

We may collect your purchase details of transactions you carry out through our Site. You may be required to provide payment information before placing an order through our Sites. We use third-party payment processors, such as Paytronix, to process payment information (e.g., credit card information), but we do not store or retain it. We recommend that you carefully review their privacy policy, where applicable.

Additionally, we may collect records and copies of your correspondence (including name, email addresses, or other contact information) if you contact us, your responses to surveys that we may ask you to complete for research purposes, and your search queries on the Sites.

As you navigate and interact with our Site, we may use automatic data collection technologies to collect certain information about your device, browsing actions, and patterns, including:

• Details of your visits to our Site, including traffic data (this may include the website you accessed the Site from), location data, logs, and other communication data, and the resources that you access and use on the Site.
• Information about your device (including any mobile device), computer, and internet connection, including model, brand, device date, IP address, operating system, mobile network, and browser type.

We may also use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking).

The information we collect automatically may include personal information. It helps us improve our Site and deliver a better and more personalized service to you by enabling us to estimate our audience size and usage patterns, store information about your preferences that allows us to customize our Site according to your individual interests, speed up your searches, and recognize you when you return to our Site.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). In addition to baking fresh cookies, we also use cookies to keep track of marketing campaigns and compile aggregate data about Site traffic and interactions, so that Great Harvest can offer the best user experience possible and provide better tools and services for future site visits. If you prefer, you may clear your browser of existing cookies or set your browser to refuse cookies. Your individual browser will likely provide instructions on disabling cookies. Please be aware that your experience on this Site may be affected by disabling cookies. To learn more about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
• Web beacons. Pages of the Site and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Great Harvest, for example, to count users who have visited those pages or opened an email and for other statistics related to our Site (for example, recording the popularity of certain Site content and verifying system and server integrity).
• Advertising and marketing pixels. We use advertising and marketing pixels for remarketing and conversion tracking purposes. The specific pixels and/or tags that we may use include, but are not necessarily limited to: Google Ads Tag and Google Tag Manager.
• Google Analytics. We use Google Analytics to optimize our Site based on the traffic we receive and assist with marketing. To learn more about Google Analytics, including options for opting out and/or managing the ads you may see online, please visit: www.google.com/policies/privacy/partners.
• Hotjar. We use Hotjar on our Site to better understand how our users interact with it and to optimize our Site and user experience. Hotjar enables us to visualize user interactions, better understand our users’ experience, and improve our services by identifying issues and friction points. To provide these services, Hotjar uses first-party cookies and other technologies to collect information on our users’ behavior and their devices on our behalf. This may include personal information like online identifiers (e.g., device’s IP address, user ID), identification data (e.g., name, email address, only if we explicitly collect it), technical data (e.g., device type and screen size, browser information), geographic location (country only), behavioral data (interactions with our Site, such as clicks, taps, scrolls), and any additional personal information that may explicitly be submitted through Hotjar. Hotjar may reuse this personal information to develop and improve tools and services for us and our users. For further details, please visit Hotjar’s [Trust Portal]([INSERT LINK]) and [Privacy Policy]([INSERT LINK]).

CATEGORIES OF PERSONAL INFORMATION COLLECTED IN THE PAST 12 MONTHS

The tables below show the categories of personal information and sensitive personal information that we have collected over the past 12 months. Please note that while examples are listed for each category, we do not necessarily collect each of those examples in all instances.

In the course of providing our products, services, or our Site to you, we may collect certain sensitive personal information about you. In the past 12 months, we have collected the categories of sensitive personal information shown in the table below.

HOW WE USE YOUR INFORMATION

We use this information to present our Site and its contents to you, provide you with the information, products, or services that you request from us, carry out our obligations, and enforce our rights arising from any contracts entered into between you and us, including for billing and collection. We also use this information to develop new services and continue to make improvements that are important to you and Great Harvest customers.

Great Harvest may also use information that you provide us to respond to your requests for information and/or services, media inquiries, identify a Great Harvest location, notify you about your account and changes to our Site or any products or services we offer or provide through it, and recommend products or services.

We may also use your personal information to fulfill any other purpose for which you provide it, in any other way we may describe when you provide the information, or for any other purpose for which we have your consent.

Like most websites, this Site gathers information such as traffic patterns and usage data to help Great Harvest understand how you use the Site.

HOW WE SHARE YOUR INFORMATION

Great Harvest may, from time to time, share your information with its third-party service provider, Google Analytics, a web analytics service provided by Google, Inc. You can learn more about Google Analytics and the privacy principles it employs to keep your information safe [here]([INSERT LINK]). Great Harvest may also use your information in connection with its third-party marketing software to implement and evaluate our marketing activities and programs, including user activity on this Site. This data may be collected on an individual basis, through information that you provide Great Harvest directly on this Site, or may be collected through the use of cookies, described above.

Additionally, Great Harvest may contract with other third-party service providers to better assist us in understanding our Site visitors and their behaviors. Great Harvest only shares personal information to third parties that are performing services directly for Great Harvest. These third-party service providers are not permitted to use the information collected on the Site and on Great Harvest’s behalf for any purpose other than to help us improve our business. These third-party service providers may not collect or use information from the Site for their own benefit or business purposes.

Great Harvest may also share your information with affiliates, franchisees, related companies, and/or investors. In the event that any transfer or sale of some or all of Great Harvest’s business or assets occurs, we may disclose your personal information to those involved in such a transfer or sale of assets.

We may also disclose your personal information to comply with any court order, law, or legal process, including to respond to any government or regulatory request; to enforce or apply our Site Terms of Use and other agreements, including for billing and collection purposes; and if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Great Harvest, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

For users of the Company’s Intranet, we may use employment-related information for purposes related to your employment with us (if you work for Great Harvest Franchising, Inc.) or with your employer.

CATEGORIES OF PERSONAL INFORMATION SHARED OR SOLD IN THE PAST 12 MONTHS

As mentioned above, we may share your personal information, including sensitive personal information, with a third party for a business purpose. In some circumstances, we may “sell” your personal information as that term is defined under certain state privacy laws. In the past 12 months, we have disclosed or sold the categories of personal information shown in the table below.

OPT-OUT AND CONTROL OVER INFORMATION

We have created the following mechanisms to provide you with the following control over your information.

Tracking Technology and Advertising. You can set your browser to refuse all or some browser cookies or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Site may then be inaccessible or not function properly.

Targeted advertising. We use remarketing services to advertise on third-party websites to you after you have visited our Site. We and our third-party vendors use cookies (either alone or in conjunction with web beacons or other tracking technologies) to collect information about you to inform, optimize, and serve ads based on your past visits to our Site. This collected information may be associated with your personal information and may also reflect your online activities over time and across different websites and other online services.

Promotional offers from us. You have the right to opt out of future marketing communications from Great Harvest at any time. You may do so by using the “unsubscribe” choice at the bottom of any email marketing material, by changing the setting in your Rewards account, or by sending an email to support@greatharvest.com. Please note that by clicking “unsubscribe,” this does not delete any personal information that Great Harvest has collected about you, but only deactivates marketing email communications.

We do not control the collection or use of your information in connection with third parties’ interest-based advertising. If you have any questions about an advertisement or other targeted content, including how to opt out of receiving targeted advertising from those parties, you should contact the responsible advertiser directly.

You may also opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website.

Residents of certain states may have additional rights and choices regarding their personal information. For more information, see below.

ACCESSING, CORRECTING, AND DELETING YOUR INFORMATION

You can review and change your personal information by logging into the Site and visiting your account profile page. You may also send us an email at support@greatharvest.com to request access to, correct, or delete any personal information that you have provided to us. For your protection and the protection of your personal information, we may require you to validate your identity before we comply with a request to access, correct, or delete your personal information. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

Residents of certain jurisdictions may have additional rights and choices regarding their personal information. For more information, see below.

“DO NOT TRACK” SIGNALS

We do not respond to Do Not Track (“DNT”) signals at this time. We will respond to such signals in the future, if and when we are required to do so.

UNIVERSAL OPT-OUT SIGNALS

We have incorporated the Global Privacy Control (GPC) into this Site. Great Harvest recognizes the GPC universal opt-out mechanism, which allows individuals to opt out of the sale and sharing of personal information. If you enable the GPC mechanism, upon receipt or detection, Great Harvest will treat the signal as a valid request to opt out of the sale or sharing of personal information linked to that browser and any rewards account Great Harvest has associated with that browser. If you use multiple browsers or browser profiles, you will have to enable the opt-out mechanism on each browser that you use.

HOW WE PROTECT INFORMATION

Great Harvest works hard to protect its Site users from unauthorized access, alteration, or disclosure of information. In doing so, Great Harvest maintains reasonable physical, electronic, and procedural safeguards to protect your personal information. Great Harvest cannot guarantee that its security measures will be sufficient to entirely prevent security problems, and it cannot guarantee that information you supply will not be intercepted while being transmitted to Great Harvest over the Internet.

The safety and security of your information also depend on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Site, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We recommend that you use particular caution when accessing your account from a public or shared computer so that others cannot view or record your password or other personal information.

YOUR STATE PRIVACY RIGHTS AND CHOICES REGARDING YOUR PERSONAL INFORMATION

State consumer privacy laws provide their residents with additional rights regarding our use of their personal information. Depending on your location, you may have the right to:

• Unsubscribe from marketing communications;
• Confirm whether we process your personal information;
• Access or receive a copy of your personal information;
• Delete your personal information, unless we are required to retain it;
• Correct inaccuracies in your personal information;
• Obtain a list of the categories of third parties to whom we have disclosed your personal information, or a list of the categories of third parties to whom we have disclosed consumers’ personal information generally;
• Data Portability;
• Opt out of the processing of your personal information for targeted advertising and “sales,” as that term is defined under applicable state consumer privacy laws;
• Opt out of profiling in furtherance of decisions that produce a legal or similarly significant effect; and
• Not be discriminated against for exercising your rights.

YOUR RIGHT TO UNSUBSCRIBE FROM MARKETING COMMUNICATIONS

As discussed above, if you no longer wish to receive marketing communications from Great Harvest, you may discontinue your subscriptions by selecting the “unsubscribe” link at the bottom of any email message, changing the appropriate setting in your rewards account, or contacting us at support@greatharvest.com.

YOUR RIGHTS TO ACCESS YOUR PERSONAL INFORMATION, CONFIRM WHETHER WE PROCESS YOUR PERSONAL INFORMATION, AND DATA PORTABILITY

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive your request and verify your identity, we will disclose to you:

• The categories of personal information we collected about you;
• The categories of sources for the personal information we collected about you;
• Our business or commercial purpose for collecting your personal information;
• The categories of third parties with whom we shared or disclosed your personal information, or the categories of third parties with whom we have disclosed consumers’ personal information generally; and
• Our business or commercial purpose for sharing or disclosing your personal information to those third parties.

Additionally, you may also request a portable copy of your personal information, which we will deliver to you in a readily usable format.

YOUR RIGHT TO CORRECT YOUR PERSONAL INFORMATION

You have the right to correct any inaccurate personal information that we have collected from you. Once we receive your request and verify your identity, we will update the inaccurate information with the correct personal information that you provide to us. Given the personal information’s nature and/or processing purpose, we may deny the request if we have reason to believe the new information is incorrect or inaccurate. This is to protect the accuracy, security, and integrity of your personal information in our possession.

YOUR RIGHT TO DELETE YOUR PERSONAL INFORMATION

You have the right to request that we delete the personal information that we have collected from you and retained, subject to certain exceptions. Once we receive your request and verify your identity, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the personal information is necessary for us or our service provider(s) to:

• Complete the transaction for which the personal information was collected or otherwise perform a contract with you;
• Fulfill the terms of a written warranty or product recall conducted in accordance with federal law;
• Provide a good or service requested by you or reasonably anticipated within the context of our ongoing relationship with you;
• Detect security incidents or protect against malicious, fraudulent, or illegal activity, or prosecute such activity;
• Debug to identify and repair errors that impair existing or intended functionality;
• Exercise free speech, ensure the right of another person to exercise his/her right of free speech, or exercise another right provided by law;
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enable internal uses that are reasonably aligned with your expectations based on our relationship with you;
• Comply with a legal obligation; or
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

YOUR RIGHT TO OPT OUT OF PERSONAL DATA PROCESSING AND “SALES”

You have the right to request that we refrain from processing your personal information for targeted advertising and “sales,” as that term is defined under applicable state consumer privacy laws. Once we receive your request, we will no longer use or process your personal information for the purpose of providing targeted advertising to you based on your activity and interests. We will also no longer sell (as that term is defined by relevant and applicable state law) your personal information to third parties for targeted advertising purposes.

To exercise this right, please visit our [Do Not Sell or Share My Information]([INSERT LINK]) webpage.

YOUR RIGHT TO OPT OUT OF PROFILING

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects on you. Once we receive your request, we will no longer use or process your personal information to make decisions that produce legal or similarly significant effects on you.

YOUR RIGHT TO NON-DISCRIMINATION

Great Harvest will not discriminate against you for exercising any of your privacy rights. Unless permitted by relevant state law, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you with a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by applicable law that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

We offer promotional or “loyalty” programs, and we may add additional programs from time to time. You may be eligible to receive discounts on products as part of your participation in a loyalty program. As described above, we may collect personal information from you when you participate in a loyalty program.

SUBMITTING A PRIVACY RIGHTS REQUEST

To exercise your privacy rights described above, please submit a verifiable consumer request to us by filling out this form: https://www.greatharvest.com/company/great-harvest-franchise-office or emailing us at support@greatharvest.com. You may also submit a deletion request and data portability through the [Data Privacy Request]([INSERT LINK]) webpage. We will respond to you within 10 days of receiving your request with additional information. We will normally fulfill your request within 45 days, although in some instances we may require additional time. We may, however, be unable to fulfill your request if we cannot verify your identity or authority to make the request. Only you or someone legally authorized to act on your behalf may make a privacy rights request. You may also make a request on behalf of your child.

You may only make a privacy rights request twice within a 12-month period.

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information in our possession or complying with your request. We may also ask you to provide additional information for verification purposes. If you provide written authorization for another person to submit requests on your behalf, we will verify your identity before responding to any such requests. In addition, if you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the individual whose personal information is the subject of the request.

You do not need to create an account with us to submit a privacy rights request.

We will only use personal information provided in the request to verify the requestor’s identity or authority to make that request.

You may appeal a decision regarding your privacy rights requests by contacting us at support@greatharvest.com.

PRIVACY OF CHILDREN

This Site is not directed toward children under the age of 13, and Great Harvest does not intentionally or knowingly collect any personal information from children under the age of 13. Great Harvest believes that parents and guardians should supervise their children’s online activities and consider utilizing parental control tools available to prevent children from disclosing their names, addresses, and other personal information online without parental permission. It is the policy of Great Harvest that visitors under 18 years of age should not submit or post anything on the Site without parental consent. Should any child under the age of 13 provide personal information, we ask that his or her parent or guardian contact Great Harvest through one of the methods listed on the [Contact Us]([INSERT LINK]) page so that we can promptly delete the child’s information from our records.

LINKS TO OTHER WEBSITES

From time to time, Great Harvest may provide links on this Site to other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the content they contain. This Privacy Policy applies solely to information collected by us through the Site and the Great Harvest mobile application. This Privacy Policy does not apply to your use of a third-party website accessed by clicking on a link on our Site. We encourage users to read the privacy statements of any third-party website before proceeding to use and/or provide information on these websites. It is your responsibility to determine when you have left this Site and entered a third-party website.

If you post certain content from this Site to Facebook, Twitter, Instagram, or any other social media account(s), the information that you post is governed by the applicable third-party website’s terms and privacy policy.

REWARDS PROGRAM

Great Harvest offers you the feature of earning product rewards via our Rewards program. An app may be downloaded to your phone or other device, or you may use a physical rewards card. Upon registering your account, we gather the following information: first & last name, state, mobile phone number, birthday and email address. This information is maintained by our third-party loyalty program processor, Paytronix Systems, Inc. (“Paytronix”). We use this information to administer the program, and it may also be used for data analytics and targeted marketing. We do not share this information with any third parties, except Paytronix. Using your rewards card or app will provide our rewards program with your purchase details. Paytronix’s privacy policy and website terms and conditions govern all loyalty transactions.

SMS NOTIFICATIONS TO REWARDS MEMBERS

Subscribers to our Rewards program can opt in to receive SMS messages sent from or on behalf of Great Harvest Bakery Cafe and our franchise locations as a part of the loyalty registration process available on our [Registration Page]([INSERT LINK]). By doing so, you agree to receive automated promotional and personalized marketing text messages from or on behalf of Great Harvest Bakery Cafe and our franchise locations to the mobile phone number you provided when signing up. Messages may pertain to promotional programs, new menu items, etc. Messages for this program will be sent from (406) 998-2516 and will begin with GH Rewards. Consent to receive automated marketing messages is not a condition of any purchase. Message frequency varies. Message and Data rates may apply.

To opt out of the text messaging program, text the keyword STOP to (406) 998-2516 to cancel. After texting STOP to (406) 998-2516, you will receive one additional message confirming that your request has been processed. For more information, text the keyword HELP to (406) 998-2516 for customer care information. You can also contact us at support@greatharvestfranchising.com, or call (406) 683-6842 for additional assistance.

Text message opt-in data and consent are not shared with any third parties, except for our franchisee locations and our message systems service providers. We do not share phone numbers with unaffiliated third parties for marketing or promotional purposes.

GIFT CARDS

Great Harvest offers you the feature of purchasing gift cards through the Site at: https://greatharvest.myguestaccount.com/en-us/guest/egift?page=cardInfo.

You may be required to provide payment information before purchasing a gift card. We use third-party payment processors, such as Paytronix, to process payment (e.g., credit card information), but we do not store or retain it. We recommend that you carefully review their privacy policy, where applicable.

FRANCHISE APPLICATIONS

Information and forms available on the “Franchising” section of this Site are applicable only to prospective franchisees. Information submitted on the online form will become a part of any application for a Great Harvest franchise that you may later submit. We may disclose your personal information submitted on the form to our business units, agents, affiliates, and to other third parties as part of our consideration of your franchise application. We do not authorize any unaffiliated third parties to use your personal information for any purpose other than consideration of your application. These third-party service providers may not collect or use information from the Site for their own benefit or business purposes.

If you would like to inquire about becoming a franchisee, please click [here]([INSERT LINK]).

CHANGES TO OUR PRIVACY POLICY

Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any changes to the Privacy Policy on this web page.

HOW TO CONTACT US

If you have any questions about this Privacy Policy or our data privacy practices, please get in touch with us:

• By our contact form: https://www.greatharvest.com/company/great-harvest-franchise-office
• By Email: support@greatharvest.com
• By Mail: Great Harvest Franchising, LLC, Attn: Privacy Officer, 28 South Montana Street, Dillon, Montana, 59725