Effective Date: July 17, 2026

This Privacy Policy explains how the operator of www.vlorefoodsplus.com ("Vlore Foods+," "Vlore," "we," "us," or "our") collects, uses, discloses, and retains personal information through the Site and related business interactions.

The Site presents a restaurant-services ecosystem that may involve food products, private-label products, menu and website services, online ordering, POS and payment solutions, savings reviews, support, and recruiting. Because different brands and third-party providers may participate in different services, this Policy explains both our direct activities and circumstances in which information may be routed to the provider responsible for a request.

1. Scope and Who Is Covered

This Policy applies to personal information collected through the Site, Site forms and uploads, telephone and email interactions initiated through the Site, Site marketing programs, business-development records, and recruiting submissions.

The Site links to Vlore Bakery, Hot Brand-It, Vlore POS+, Vlore Shift4, Swipe Saver, Fresh Print Menu, Shopify or other online stores, distributors, processors, and other websites or services. This Policy does not automatically govern a linked site or service unless that site expressly posts or adopts this Policy. Review the privacy notice presented where you submit information or complete a transaction.

This Policy does not replace privacy terms in a merchant agreement, processor agreement, client data-processing addendum, employment notice, or other Specific Agreement. Those terms control within their scope.

2. Our Roles: Direct Business and Service Provider

• Direct business or controller role
  We determine the purposes and means of processing when we collect information for Site operation, inquiries, sales, relationship management, our own marketing, recruiting, security, legal compliance, and administration.
• Referral or coordination role
  When a request concerns a particular Vlore brand, processor, distributor, POS provider, storefront, or other provider, we may route information to that party so it can evaluate or fulfill the request. That party may process information under its own privacy notice and agreements.
• Service-provider or processor role
  When we handle personal information solely on behalf of a merchant or business client - for example, to provide a website, online ordering, loyalty, support, or another contracted service - the client may control the information and our processing is governed by the client agreement and instructions. Individuals should ordinarily direct requests concerning that client-controlled data to the client.

The role that applies depends on the interaction, data, and written agreements. Contact us if you need help identifying the responsible party.

3. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories. We do not necessarily collect every item from every person.

• Identifiers and contact details
  Name, business name, title, username, mailing or business address, email address, telephone number, account identifiers, and similar details.
• Business and restaurant profile
  Business type, locations, operating hours, cuisine, distributor relationships, equipment, POS environment, technology needs, menu information, product interests, shipping or service locations, and other operational details.
• Commercial and relationship information
  Products or services requested, samples, orders, quotes, proposals, contracts, subscriptions, support history, project status, preferences, promotions, and communications.
• Merchant and financial information
  Merchant-processing statements, transaction summaries, fees, card mix, average ticket, chargeback information, banking details when required through an approved process, ownership or underwriting information, and related records. We do not ask you to submit complete cardholder credentials through a general Site form.
• Content and submitted files
  Menus, logos, labels, artwork, photographs, product data, brand materials, proofs, website content, feedback, documents, and metadata associated with uploaded files.
• Communications and consent records
  Emails, text messages, call notes, form responses, appointment information, support interactions, marketing choices, opt-in and opt-out records, and evidence of consent.
• Device and internet activity
  IP address, device and browser type, operating system, referring pages, pages viewed, links selected, dates and times, session information, cookie identifiers, approximate location derived from IP address, and security or diagnostic data.
• Applicant and workforce information
  Resume, work history, education, skills, availability, interests, references, portfolio or work samples, interview notes, communications, and other information voluntarily provided for recruiting.
• Sensitive personal information
  Information such as account credentials, precise financial details, government identifiers, or other sensitive data only when reasonably necessary for a requested transaction, underwriting, employment, security, or legal purpose. General Site forms should not be used to submit unnecessary sensitive information.
• Inferences
  Business interests, likely service needs, engagement level, preferences, or other conclusions derived from information described above.

4. Sources of Personal Information

We may obtain personal information from:

• You
  Through forms, uploads, calls, texts, emails, sample or quote requests, savings reviews, orders, applications, meetings, and support interactions.
• Your business or representatives
  Owners, managers, employees, consultants, agents, accountants, existing providers, references, or other people authorized to interact with us.
• Related brands and business partners
  Vlore-branded businesses, processors, acquiring banks, distributors, POS and equipment providers, software and integration partners, referral sources, marketplaces, and other providers involved in a request or relationship.
• Service providers
  Website hosts, analytics providers, communications vendors, CRM systems, document-storage services, security providers, recruiting tools, and other vendors that support our operations.
• Public and commercial sources
  Business websites, social media, government or licensing records, professional directories, public filings, and commercially available business information.
• Cookies and similar technologies
  Information generated when you use the Site, as described in Section 10.

5. How We Use Personal Information

We may use personal information to:

• operate, maintain, secure, troubleshoot, and improve the Site;
• respond to inquiries and coordinate samples, quotes, savings reviews, demonstrations, consultations, applications, orders, projects, installation, training, or support;
• evaluate business needs and route a request to the relevant brand, processor, distributor, POS provider, service provider, or other responsible party;
• prepare pricing, proposals, processing comparisons, product recommendations, designs, menus, labels, websites, online-ordering configurations, or other requested work;
• perform underwriting, identity, ownership, eligibility, fraud, risk, sanctions, or compliance checks when applicable and permitted;
• create and administer accounts, contracts, orders, subscriptions, projects, invoices, payments, equipment, support cases, and relationship records;
• communicate about requests, transactions, services, security, changes, renewals, and other operational matters;
• send marketing when permitted and honor communication preferences and opt-outs;
• recruit, evaluate, communicate with, and maintain records concerning applicants;
• analyze Site use, campaign performance, service demand, and business trends;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, legal violations, disputes, and prohibited conduct;
• exercise or defend legal rights, enforce agreements, meet tax and accounting obligations, respond to lawful requests, and comply with law; and
• create aggregated or de-identified information that cannot reasonably be linked to an individual and use it for lawful purposes.

6. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients, subject to applicable law and agreements:

• Related brands and affiliated businesses
  To coordinate an inquiry, provide integrated services, manage the business relationship, administer shared operations, or perform functions described in this Policy.
• Processors, acquiring banks, POS providers, and financial-service partners
  To evaluate a merchant request, perform underwriting, prepare pricing, establish or support services, process transactions, manage risk, or satisfy program requirements.
• Food suppliers, distributors, storefronts, fulfillment and logistics providers
  To process sample or product requests, confirm availability, ship or deliver products, manage returns, or support distribution relationships.
• Creative, printing, website, online-ordering, signage, software, and integration providers
  To evaluate, build, host, publish, print, deploy, maintain, or support requested services.
• Operational service providers
  Website hosting, cloud storage, CRM, analytics, communications, document management, customer support, security, recruiting, accounting, payment, legal, and other vendors that perform services for us.
• Professional advisers
  Lawyers, accountants, auditors, insurers, consultants, and other advisers subject to appropriate duties.
• Authorities and protective parties
  Government agencies, courts, law enforcement, regulators, card networks, financial institutions, security researchers, or affected parties when reasonably necessary to comply with law, protect rights or safety, investigate fraud or abuse, or respond to a security event.
• Business transaction participants
  Potential or actual buyers, sellers, lenders, investors, successors, or advisers in connection with a merger, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate protections.
• At your direction or with your consent
  Other recipients you authorize or intentionally interact with.

We do not sell SMS opt-in data or disclose mobile numbers and text-message consent to third parties or affiliates for their own independent marketing without separate consent. We may disclose that information to communications vendors and carriers solely to operate the messaging program, prevent abuse, and comply with law.

7. Merchant Statements, Underwriting, and Payment-Related Information

Merchant statements and payment-related records may contain sensitive commercial and personal information. We use them to respond to the requested review, compare processing arrangements, prepare proposals, evaluate eligibility, prevent fraud, comply with law, and support an active relationship.

We may disclose relevant information to processors, acquiring banks, independent sales organizations, POS providers, consultants, and vendors involved in the review or application. Those parties may collect additional information directly and may act as independent businesses under their own notices and agreements.

Do not use a general Site form to submit complete card numbers, card verification values, PINs, Social Security numbers, bank-login credentials, or information unrelated to the request. Redact unnecessary information and use only approved upload channels. We may restrict or delete files that contain prohibited or unnecessary sensitive data.

8. Merchant- or Client-Controlled Data

Some services may involve information about a merchant's customers, employees, users, orders, reservations, loyalty members, or website visitors. When we process that information solely for a business client, the client determines the purposes and means of processing and is responsible for notices, consents, lawful instructions, and responding to individual rights.

We process client-controlled data as described in the client agreement and instructions, including to provide, secure, support, and improve the contracted service; prevent fraud and abuse; comply with law; and create permitted aggregated or de-identified information. We do not use client-controlled data for unrelated independent marketing unless authorized by the individual and permitted by the client agreement and law.

To exercise a right concerning information held by a restaurant or other client, contact that business first. We will assist the client where required by contract or law.

9. Sale, Sharing, and Targeted Advertising

We do not sell personal information for money. We may use analytics or advertising technologies that disclose identifiers, device information, internet activity, or approximate location to advertising or analytics partners. Some state privacy laws may define those disclosures as a "sale," "sharing," or use for "targeted advertising," even when no money changes hands.

Where applicable, you may opt out by using a "Your Privacy Choices" or similar control made available on the Site, enabling a legally recognized browser-based opt-out signal such as Global Privacy Control, or contacting us as described in Section 14. The availability and effect of a control depend on applicable law and the technologies actually used on the Site.

We do not knowingly sell or share the personal information of individuals under 16. We do not use sensitive personal information to infer characteristics unrelated to the requested product, service, employment process, security, or legal obligation.

10. Cookies and Similar Technologies

We and our providers may use cookies, pixels, tags, local storage, scripts, and similar technologies. Depending on the Site configuration, these technologies may include:

• Strictly necessary technologies
  Support core Site operation, security, network management, form submission, load balancing, consent choices, and fraud prevention.
• Functional technologies
  Remember preferences and support enhanced functions such as embedded content, chat, scheduling, maps, or media.
• Analytics technologies
  Measure visits, traffic sources, navigation, interactions, performance, and errors so we can understand and improve the Site.
• Advertising technologies
  Measure campaigns, create or use audiences, limit repeated advertising, and display or assess advertising across websites or services.

You can manage cookies through available Site controls and browser settings. Blocking some technologies may affect Site functions. Browser or device settings do not necessarily control every technology. Where required, we request consent before using non-essential technologies and honor applicable opt-out signals.

We do not currently respond to older browser "Do Not Track" signals that lack a uniform legal or technical standard. We process Global Privacy Control or another legally recognized opt-out signal where required by applicable law.

11. Email, Telephone, and Text Communications

We may send service-related communications about inquiries, samples, quotes, applications, orders, projects, accounts, security, and contracts. We send marketing only as permitted by law and the choices you make. Marketing consent is not a condition of purchase.

You may unsubscribe from promotional email through the link in the message. You may opt out of promotional texts by replying STOP or using another reasonable method. We may retain a limited suppression record to honor the request. Opting out of marketing does not stop non-marketing communications reasonably necessary for a request, transaction, account, safety issue, or legal obligation.

When a form names multiple brands or senders, your consent applies only to those specifically identified. An inquiry about one service does not automatically authorize unrelated marketing by every linked brand.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose collected, an active client instruction, our legitimate business needs, or legal requirements. The principal criteria include:

• Inquiries, leads, sample requests, and relationship records
  For as long as reasonably needed to respond, follow up, coordinate with the relevant provider, maintain relationship history, resolve disputes, and meet legal or accounting requirements.
• Merchant statements and savings analyses
  Until the requested review and reasonable follow-up are complete, then deleted or de-identified unless needed for an active application or relationship, fraud prevention, a dispute, a legal requirement, or a documented business need.
• Applications, contracts, orders, projects, support, and transaction records
  For the relationship term and afterward for the period reasonably needed for performance, warranties, support, equipment recovery, accounting, tax, audit, enforcement, and legal claims.
• Menus, logos, labels, websites, and other submitted business assets
  For as long as needed to evaluate or deliver the requested service, support revisions or reorders, document approvals, maintain project history, or comply with a contract or law.
• Applicant information
  For the recruiting process and a reasonable period afterward for future opportunities, compliance, recordkeeping, and potential claims, unless law or an applicable notice requires a different period.
• Marketing and consent records
  Until you unsubscribe or consent is no longer valid, plus a limited suppression and evidence record so we can honor and document the choice.
• Site logs, cookies, and analytics
  For the period reasonably needed for security, troubleshooting, analytics, campaign measurement, and legal compliance, after which the information is deleted, aggregated, or de-identified according to provider settings and our needs.

We may retain information longer for a litigation hold, investigation, fraud prevention, security incident, legal obligation, or the establishment, exercise, or defense of legal claims. We may retain aggregated or de-identified information that cannot reasonably be linked to an individual.

13. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, considering the nature of the information and risks involved. Measures may include access controls, approved service providers, secure transmission or storage methods where appropriate, logging, training, retention limits, and incident-response procedures.

No website, transmission, storage system, or security measure is completely secure, and we cannot guarantee absolute security. Do not send highly sensitive information through an unapproved channel. Contact us promptly if you believe information or credentials associated with us have been compromised.

14. U.S. State Privacy Rights

Depending on your residence and whether the applicable law covers us and the relevant information, you may have rights to:

• confirm whether we process personal information and access or obtain a copy of it;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• obtain certain information in a portable format;
• opt out of sale, sharing, or targeted advertising as defined by applicable law;
• limit certain uses or disclosures of sensitive personal information where applicable;
• appeal a decision on a privacy request; and
• receive equal service and not be unlawfully discriminated against for exercising privacy rights.

To submit a request, email info@vlorefoodsplus.com with the subject "Privacy Request," call 312-447-3030, or write to the address in Section 21. Describe the right you want to exercise and provide enough information for us to locate relevant records. We may verify identity and authority before completing a request. An authorized agent may submit a request where permitted, but we may require proof of authorization and direct verification with you.

If we deny a request and applicable law provides an appeal right, reply to our decision with "Privacy Appeal" and explain why it should be reconsidered. We will not unlawfully discriminate against you for exercising a privacy right. We do not currently offer a program that provides financial incentives in exchange for personal information.

15. California Privacy Notice

This section supplements the rest of this Policy for California residents if the California Consumer Privacy Act, as amended ("CCPA"), applies to us and the relevant information. During the 12 months preceding the effective date, depending on the interaction, we may have collected and disclosed the following categories for business purposes:

• Identifiers
  Collected; disclosed to related brands, service providers, financial-service and technology partners, distributors, advisers, authorities, and transaction participants. Identifiers may also be disclosed through analytics or advertising technologies if enabled.
• Customer-record and commercial information
  Collected; disclosed to related brands, service providers, processors, POS providers, distributors, storefronts, advisers, authorities, and transaction participants.
• Financial information
  Collected when needed for merchant review, underwriting, payment, refund, or contracting; disclosed to processors, acquiring banks, payment providers, professional advisers, authorities, and service providers involved in the purpose.
• Internet or other electronic network activity
  Collected; disclosed to hosting, analytics, security, communications, and advertising providers depending on the technologies enabled.
• Approximate geolocation
  May be derived from IP address and disclosed to hosting, analytics, security, and service providers.
• Professional or employment-related information
  Collected from business contacts and applicants; disclosed to related businesses, recruiting or verification providers, advisers, authorities, and transaction participants.
• Inferences
  Created from the information described above; disclosed to service providers, related businesses, and relevant partners for the purposes described in this Policy.
• Sensitive personal information
  May be collected when required for underwriting, payments, security, legal compliance, or employment. Used and disclosed only for permitted operational purposes and not to infer unrelated characteristics.

The categories of sources, purposes, recipient categories, and retention criteria are described in Sections 3 through 12. We do not sell personal information for money. Depending on the technologies enabled, disclosure of identifiers and internet activity for cross-context behavioral advertising may be considered "sharing" under California law.

California residents may request access to categories and specific pieces of personal information, deletion, correction, and information about collection and disclosure; may opt out of sale or sharing; and may limit certain uses of sensitive personal information where the law provides that right. We may retain or decline to delete information when a statutory exception applies, including to complete a transaction, provide a requested service, maintain security, comply with law, or exercise legal rights.

16. Applicant Privacy

We use applicant information to evaluate qualifications and interests, communicate about opportunities, schedule interviews, verify information where permitted, maintain recruiting records, comply with law, protect rights and safety, and consider a person for future roles when appropriate.

Applicant information may be disclosed to related businesses that may have a relevant opportunity, recruiting and communications providers, background or reference providers when authorized, professional advisers, authorities, and transaction participants. Do not include sensitive information that has not been requested through an approved process.

17. Children

The Site is directed to businesses and adult applicants and is not intended for children under 13. We do not knowingly collect personal information from children under 13 through the Site. Contact us if you believe a child submitted personal information so we can investigate and take appropriate action.

We do not knowingly sell or share for targeted advertising the personal information of individuals under 16.

18. International Visitors

We are based in the United States. Personal information may be processed and stored in the United States and other locations where our providers operate. Privacy laws in those locations may differ from those where you live. Where required, we use appropriate legal mechanisms for cross-border transfers.

19. Third-Party and Related-Brand Sites

This Policy does not govern a linked website, storefront, distributor, processor, bank, POS platform, delivery service, social network, video provider, or other third party unless that service expressly adopts this Policy. Those parties may collect information directly and use it under their own notices and agreements.

Review the notice presented at the point of collection. Contact the third party directly to exercise rights concerning information it controls. We are not responsible for another party's privacy or security practices merely because the Site links to or coordinates with that party.

20. Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy with a new effective date and provide additional notice or obtain consent when required. Changes apply prospectively unless otherwise stated and permitted by law.

21. Contact Us

Questions and privacy requests may be sent to: