LAST REVIEWED: 04-01-14

SFSC PRIVACY STATEMENT

Subway Franchise Systems of Canada, Ltd.
Calgary, Alberta, Canada

TABLE OF CONTENTS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
1.

Scope of This Privacy Statement

SFSCs Commitment: Adhering to the 10 Privacy Principles
Consent
Consent to Share and Disclose Personal Information, Including International Data
Transfers
Consent To Electronic Notice If There Is A Security Breach
Our Use of Your Personal Information and Type of Personal Information We May
Collect
Personal Information We Collect That You Provide Us
Internet Users Cookies, Internet Protocol (IP) Address, Aggregate Information
Compliance With The Digital Advertising Alliance
Interest-Based/Online Behavioral Advertising
Do Not Track
SFSCs Collection of Personal Information Regarding Children
Collection and Use of Employee Personal Information
Verifications of Employment
Collection and Use of SUBWAY Franchisee and Prospective Franchisee Personal
Information
Collection and Use of Development Agent Personal Information
Mobile Information
Mobile Marketing Promotions and Advertising
Forward-To-A-Friend and Refer-A-Friend
Opt-Out of Email Updates
Sharing of Personal Information
Security
Storage, Retention, and Accuracy of Personal Information
Access, Control, and Update Personal Information
SFSC Privacy Officer Contact Information
Links to Non-SFSC Websites and Third-Parties
Social Media and Online Engagement
Your California Privacy Rights
U.S. EU and the U.S. Swiss Safe Harbor Compliance
Residents of the European Union, European Economic Area, and Switzerland
International Privacy Statements
Changes to SFSCs Privacy Statement
Terms and Conditions of Website Use

Privacy Statement

Your privacy is very important to us. This Privacy Statement discloses how Subway Franchise
Systems of Canada, Ltd. (SFSC) collects, protects, uses and shares personal information

gathered about you in conformance with Canadas Federal Privacy Legislation, the Personal
Information Protection and Electronic Documents Act, S.C., 2000 ("PIPEDA"), and the 10
Privacy Principles developed by the Canadian Standards Associations. Our privacy
practices are consistent with:

The U.S.-EU and U.S.-Swiss Safe Harbor Frameworks Privacy Principles of: Notice,
Choice, Onward Transfer (Transfers to Third Parties), Security, Data Integrity, Access,
and Enforcement.
The Organization for Economic Co-operation and Development (OECD) Privacy
Principles.
The Federal Trade Commissions Fair Information Practice Principles (FIPPs).
The Asia Pacific Economic Cooperation forum (APEC) Privacy Framework.
Applicable Provincial Privacy Legislation, country, national, state and local data
protection laws (some countrys laws require country specific information in a Privacy
Statement.

SFSC may share information, including Personal Information with its affiliate, Franchise World
Headquarters, LLC (FWH), which operates as a service-oriented company for and on behalf of
the SUBWAY System by providing core business related services such as, but not limited to:
sales, research and development, marketing franchises, franchisee training, retail technology,
POS system support, store design, legal and accounting services, to the SUBWAY franchising
entities. FWH is licensed to use the SUBWAY trademark. Doctors Associates Inc. (DAI),
owns the trade name and service mark SUBWAY, the recipes, formulas, food preparation
procedures, business methods, business forms, and business policies. DAI is the franchisor of
the SUBWAY system for the United States, does business as "SUBWAY" and licenses the
SUBWAY trademark and SUBWAY Restaurant System to its affiliates in order to develop
SUBWAY restaurants worldwide.
FWH and DAIs affiliates include, but are not limited to: Subway International B.V. (SIBV) the
franchisor of the SUBWAY system for Europe (and the rest of the world, outside of the United
States, Australia, Canada, Colombia, Brazil, South Africa, and India), Subway Systems Australia
Pty Ltd (SSA), Subway Franchise Systems of Canada, Ltd. (SFSC), Subway Partners
Colombia C.V. (SPCCV), Subway Systems do Brasil Ltda. (SSB), Sandwich and Salad
Franchises of South Africa Pty Ltd. (SSFSA), and Subway Systems India Private Limited
(SSIPL). PT Subway Systems Indonesia (PTSSI) is a service company which provides
business related services exclusively to Indonesias SUBWAY franchisees, for and on behalf of
SIBV, the franchisor for Indonesia. FWH, DAI, SIBV, SSA, SFSC, SPCCV, SSB, SSFSA, SSIPL,
and PTSSI are collectively referred to herein as the SUBWAY Group.
SFSC may share information, including Personal Information with its affiliate, Subway Real
Estate, LLC (SRE) which assists franchisees of the SUBWAY Group in negotiating real estate
leases, administering the leases and lease renewals for all restaurant premises that they
sublease to franchisees, as well as SREs leasing affiliates worldwide, which includes, but is not
limited to: Subway Real Estate Corp. (SREC), Subway Realty of the Netherlands B.V., Subway
Realty Limited, (SRL), Subway of Ireland Limited, Subway Partners Realty N.V., Subway Realty
de Venezuela, C.A., Subway Real Estate Limited, Subway Realty de Mexico, S.A. de C.V.,
Subway Real Estate of France S.A.R.L., Subway Vermietungs und Servicegesellschaft mbH,
Subway Realty of Spain, S.L., Subway Realty of Italy S.r.l., Subway Subs of Sweden AB, Subway
International B.V. Taiwan Branch, and Subway Realty do Brasil, Ltda.
SFSC may share information, including Personal Information, with the following SUBWAY
Group advertising entities: Subway Franchisee Advertising Fund Trust, Ltd. (SFAFT) is a
Connecticut statutory trust, with a business address at 325 Bic Drive, Milford, CT 06461. Subway
Franchisee Advertising Fund Trust, B.V. (SFAFT BV) is a Netherlands limited liability company,

with a business address at Prinsengracht 13, 1015 DK Amsterdam. Subway Franchisee

Advertising Fund of Australia Pty. Ltd. (SFAFA) is a company limited by shares, with a business
address at Level 1, 42 Amelia Street, Fortitude Valley, Queensland, 4006, Australia. Subway
Franchisee Advertising Fund of Canada, Inc./Le Fond De Publicit Des Franchiss Subway Du
Canada Inc. (SFAFC) is a federal corporation, with a business address at Monarch Registries,
11210-107 Avenue NW, Main Floor, Ed Monton, AB T5H 0Y1. Subway Franchisee Canadian
Advertising Trust (SFCAT) with a business address at Monarch Registry 11210-107 Ave. NW,
Main Floor, Edmonton, AB T5H 0Y1. The FAF Group administers national and local advertising
funds and activity for SUBWAY restaurants and SUBWAY franchisees worldwide. SFAFT,
SFAFT BV, SFAFA, SFAFC, and SFCAT, are collectively referred to herein as the FAF Group.
SFSC may share information, including Personal Information, with our third party service
providers including, but not limited to: Independent Purchasing Cooperative, Inc. (IPC), and its
wholly owned subsidiary Value Pay Services LLC (VPS), European Independent Purchasing
Cooperative (EIPC), Latin America and Caribbean Independent Purchasing Cooperative
(LACIPC), Independent Purchasing Cooperative (Australasia) Limited (IPCA) and Middle East
Independent Purchasing Cooperative (MEIPC), all of which are member owned and operated
entities, composed of all SUBWAY Franchisees located in the geographical areas as follows: the
United States of America and its territories and Canada and its provinces (IPC), European Union
(EIPC), Latin America and Caribbean (LACIPC), Australia and New Zealand (IPCA) and the
Middle East (MEIPC). IPC, EIPC, LACIPC, IPCA and MEIPC, are collectively referred to herein
as the Co-op Group.
All Personal Information is collected in a fair and non-intrusive manner, with your voluntary
consent. Personal Information is not accessible to anyone outside the specific function for which it
is collected. SFSC respects the privacy of our SUBWAY customers, our employees, job
applicants, and other visitors to our websites who may choose to provide Personal Information.
We recognize the need for appropriate protections and management of Personal Information that
you provide to us. This Privacy Statement will assist you to understand what types of Personal
Information we may collect, how that Personal Information may be used, and with whom the
Personal Information may be shared with.
This Privacy Statement explains SFSCs privacy practices and procedures regarding the
Personal Information collected online from users of the SUBWAY Restaurant Systems website
located at: www.subway.com. As noted above, SFSC is the franchisor licensed to sell SUBWAY
restaurants Canada.
In an effort to comply with the law, and our commitment to protect your Personal Information, we
provide the following, which discloses SFSCs privacy practices and procedures. Please note this
Privacy Statement does not govern the privacy practices and procedures of independently
owned and operated SUBWAY restaurants. Nor does this Privacy Statement govern the
Personal Information handling practices and procedures of its affiliates, the SUBWAY Group
and the FAF Group. SFSC encourages you to review its affiliates, the SUBWAY Groups,
respective Privacy Statements which discloses each companys privacy practices and
procedures. For your convenience, SFSC has provided a link to DAI, FWH, and SFAFTs
individual Privacy Statements, as well as, the Privacy Notice which includes the individual
SUBWAY Groups franchisor Privacy Statement links below:
FWH: http://www.subway.com/subwayroot/PrivacyPolicy-FWH.aspx,
DAI: http://www.subway.com/subwayroot/PrivacyPolicy-DAI.aspx,
SFAFT: http://www.subway.com/subwayroot/PrivacyPolicy-SFB.aspx
Privacy Notice: http://www.subway.com/subwayroot/privacyNotice.aspx

2. SFSCs Commitment: Adhering to the 10 Privacy Principles

In Canada, "Fair Information Practices" regarding your personal information are reflected in a
series of 10 Privacy Principles developed by the Canadian Standards Association and
incorporated into Canadian federal privacy legislation, the Personal Information Protection and
Electronic Documents Act ("PIPEDA"). SFSC adheres to the 10 Privacy Principles as follows:
Principle 1 Accountability
SFSC is responsible for personal information under its control and has designated a
Privacy Officer who is accountable for SFSCs compliance with this Privacy Policy and
the applicable privacy legislation for Canada and its provinces.
Principle 2 Identifying the Purposes for collection of Personal Information
SFSC will identify the purposes for which your personal information is collected at or
before the time the personal information is collected. Some of the identified purposes for
which SFSC collects, uses, and discloses your personal information are described below
in this Privacy Policy. If we intend to collect, use or disclose your personal information for
additional purposes, we will seek your consent.
Principle 3 Consent for Collection, Use of Disclosure of Personal Information
SFSC will obtain your informed consent for the collection, use, or disclosure of your
personal information, except as permitted by law.
Principle 4 Limiting Collection of Personal Information
SFSC will limit the collection of personal information, both the amount and the type of
information, to that which is necessary for the purposes identified by SFSC. SFSC will
collect your personal information by fair and lawful means, and not by misleading or
deceiving you about the purpose for which information is being collected.
Principle 5 Limiting Use, Disclosure, and Retention of Personal Information
SFSC will not use or disclose personal information for purposes other than the identified
purposes for which it was collected, except with your consent or as required or permitted
by law. SFSC will retain your personal information only as long as necessary to fulfill the
identified purposes.
Principle 6 Accuracy of Personal Information
SFSC will attempt to make sure that your personal information will be as accurate,
complete and up-to-date as is necessary for the purposes for which it is to be used.
Principle 7 Security Safeguards
SFSC will protect your personal information by security safeguards appropriate to the
sensitivity of the information.
Principle 8 Openness Concerning Policies and Practices
SFSC will make readily available to you specific information about our policies and
practices relating to the management of personal information.
Principle 9 Individual Access to Personal Information
Upon written request, subject to certain exceptions, SFSC will inform you of the
existence, use, and disclosure of your personal information and will give you access to
that information. An individual shall be able to challenge the accuracy and completeness
of the information and have it amended as appropriate.
Principle 10 Challenging Compliance
You have the right to address a challenge concerning compliance with this Privacy Policy
to SFSCs Privacy Officer.
3. Consent
This Privacy Statement applies to all information gathered for and on behalf of SFSC, whether in
writing, verbally or electronically, through any website operated by or on behalf of SFSC,
including, but not limited to: www.subway.com, together with any and all future websites (the
Websites) operated by or on behalf of SFSC. By using the Websites, or participating in any

program or service managed by SFSC, you consent to the data practices described in this
Privacy Statement.
BY SUBMITTING PERSONAL INFORMATION TO SFSC, AND/OR BY ACCESSING AND
USING THE WEBSITE, YOU AGREE TO SFSCS COLLECTION, USE, AND DISCLOSURE OF
SUCH PERSONAL INFORMATION IN ACCORDANCE WITH THIS PRIVACY STATEMENT
AND THE TERMS AND CONDITIONS AS PERMITTED OR REQUIRED BY LAW.
If you have questions about this Privacy Statement or the protection of your Personal Information,
please contact SFSCs Privacy Officer at: privacyofficer@subway.com.
4. Consent to Share and Disclose Personal Information, Including International Data
Transfers
In addition to consenting to the website Privacy Statement, Terms and Conditions, as well as any
relevant supplemental policies, you expressly consent to SFSC sharing the Personal
Information that you have provided to SFSC, as described herein. SFSC may share Personal
Information with its affiliates and/or third-party service providers, including, but not limited to: the
SUBWAY Group, the FAF Group, the Co-op Group, and VPS. SFSC may also share your
Personal Information with companies that provide support services to SFSC, such as, but not
limited to: credit card processors, mailing houses, web hosts, technical support providers,
fulfillment centers, enforcing and/or investigating business operations or transactions, because
these companies may need information about you in order to perform their various functions.
Please note, SFSC does not control these companies nor does SFSC authorize these
companies to use your Personal Information that SFSC may share with them, for any reason
other than the purpose for which SFSC hired them. You agree that SFSC and those with whom it
shares your Personal Information (the Recipients), may disclose and transfer your Personal
Information worldwide, including in and outside of the United States and its territories, the
European Economic Area, Canada and its provinces, and other geographical areas serviced by
the SUBWAY Group, for any purpose relating to SFSCs operations and programs.
5. Consent to Electronic Notice If There Is a Security Breach
If SFSC or a Recipient is required to provide notice of unauthorized access of certain security
systems, you agree that SFSC, or the Recipient, may do so when required or voluntarily by
posting notice on the Website or sending notice to any email address SFSC or the Recipient has
for you, in the good faith discretion of SFSC or the Recipient. You agree that notice to you will
count as notice to any other individual for whom you are acting and agree to provide the notice to
any such individual.
5. Our Use of Your Personal Information and Type of Personal Information We May Collect
We use your Personal Information to facilitate the services you request. We have tailored our
Privacy Statement to adequately advise you of the use of your Personal Information.
Personal Information is defined as any information concerning the personal or material
circumstances of an identified or identifiable individual. An identifiable person is one who can be
identified, directly or indirectly, by reference to a Social Security Number and/or Identification
Number (hereinafter SSN/I.N) or to one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity.
Personal Information shall include, but is not limited to: name (full name or first initial and last
name), maiden name, nickname, email address, home address, home postal code, home
telephone number, mobile telephone number, date of birth, Social Security Number and/or

Identification Number, photographic images (especially of face or other identifying characteristics,

or other identifying characteristics such as eye, skin, and hair color, facial features, and personal
marks such as tattoos, birthmarks, moles and scars) and video or voice recording, financial
information, and employment related information, such as: Personal Information that may be
found on resumes, applications, background verification information, or in employment
references.
SFSC takes measures to maintain the confidentiality of your SSN/I.N to protect your SSN/I.N
from unlawful disclosure, and to limit access to your SSN/I.N. SFSC will not make your SSN/I.N
available to the general public, print your SSN/I.N on any card, require you to provide your
SSN/I.N to access any products or services, transmit your SSN/I.N over the Internet unless the
connection is secure or your SSN/I.N has been encrypted, or requires the transmittal of your
SSN/I.N to access our Website without requiring additional authentication.
Non-Personal Information is information that is already a matter of public record or knowledge.
Business contact information is considered Non-Personal Information and not subjected to
special protection and it can be routinely shared with anyone inside or outside of the business.
Business contact information shall include but is not limited to: business name, business address,
business telephone number, and is not considered Personal Information in certain jurisdictions.
WE DO NOT COLLECT SENSITIVE PERSONAL DATA
Sensitive Personal Information is information that can include but is not limited to, an individuals
gender, racial or ethnic origins, politics, religion, trade union membership, veteran status, physical
or mental health, disabilities, sex life, sexual orientation, or criminal (or alleged criminal) activities,
proceedings or convictions. We will never collect Sensitive Personal Information except to comply
with Affirmative Action data requirements.
6. Personal Information We Collect That You Provide Us
SFSC will not collect customer Personal Information, unless the customer contacts SFSC directly.
In order to adequately address a customers concern, your Personal Information may be shared
with our affiliates within the SUBWAY Group, third-party service providers, the appropriate
SUBWAY Groups area Development Agent (DA), and franchisees.
Holders of SUBWAY Loyalty Cards and SUBWAY Gift Cards (collectively the SUBWAY
Card) may voluntarily register their cards through www.mysubwaycard.com. Our third party
service provider collects Personal Information on a voluntary basis. This information is used as
part of the Lost/Stolen Card Program. If you do not wish to receive promotional materials with
your use of the SUBWAY Card you may update your preferences at www.mysubwaycard.com.
YOU MUST HAVE REACHED THE AGE OF MAJORITY TO REGISTER A SUBWAY CARD.
For Instance, you may choose to communicate with us in some of the following ways:

Subscription Services, such as, email and newsletters.

User registration, such as access to www.subway.com, member or non-public member
pages.
Financial Transaction Information, such as, ordering from http://shop.subway.com/,
operated by Franchise Shipping Center Company, Inc. (FSC);
Placing a catering order or signing up for a SUBWAY Card with our third party service
providers, IPC and/or VPS at: www.mysubwaycard.com, Subway Express,
www.tellsubway.com, and www.subwaycatering.com, operated by, VPS.
Promotions and Sweepstakes.
Surveys and/or Voting.

Upon entering your Personal Information regarding any of the above, other members of the
SUBWAY Group, and FWHs third-party service providers, are contractually obligated to provide
the same level of guarantees regarding the confidentiality and security of your Personal
Information, as well as, to allow for oversight, monitoring, and auditing of the services being
provided. SFSC does not divulge User ID and Passwords to anyone internally or externally.
Please note, when entering a Promotion or Sweepstake SFSC urges you to review the Promotion
or Sweepstake Official Rules and Privacy Statement specific to that Promotion or Sweepstakes.
7. Internet Users - Cookies, Internet Protocol (IP) Address, Aggregate Information
Cookies - In addition to Personal Information, we use data collection devices such as "cookies"
on certain web pages to help analyze our web page flow and measure promotional effectiveness.
A cookie is a text-only string of information that a website transfers to the cookie file of the
browser on your computer's hard disk so that the website can remember who you are. A cookie
will typically contain the name of the domain from which the cookie has come, the 'lifetime' of the
cookie, and a value, usually a randomly generated unique number. This helps us to provide you
with a good experience when you browse our website and also allows us to improve our site and
services.
A few important things you should know about cookies are that:

We offer certain features that are available only through the use of cookies.
We use cookies to better your web experience.
Most cookies are "session cookies," meaning that they are automatically deleted from
your hard drive at the end of a session.
You may encounter cookies from third parties on certain pages of the sites that we do not
control. (For example, if you view a web page created by another user, there may be a
cookie placed by that web page.)

Disabling/enabling cookies - You have the ability to accept or decline cookies by modifying the
settings in your browser. However, you may not be able to use all the interactive features of our
site if cookies are disabled.
Web Beacon - Also called a Web bug or a pixel tag or a clear GIF. We use pixels tags or
transparent GIF files, to help manage our online advertising and promotions. These tags collect
anonymous (not personally identifiable) information about which advertisements and promotions
bring users to our website. With both cookie and tag technology, the information that we collect
and share is anonymous and not personally identifiable. It does not contain your name, address,
telephone number, or email address.
Used in combination with cookies, a Web beacon is an often-transparent graphic image, usually
no larger than 1 pixel x 1 pixel, which is placed on a website or in an e-mail that is used to
monitor the behavior of the user visiting the website or sending the e-mail. When the HTML code
for the Web beacon points to a site to retrieve the image, at the same time it can pass along
information such as the IP address of the computer that retrieved the image, the time the Web
beacon was viewed and for how long, the type of browser that retrieved the image and previously
set cookie values.
Web beacons are typically used by a third-party to monitor the activity of a site. A Web beacon
can be detected by viewing the source code of a Web page and looking for any IMG tags that
load from a different server than the rest of the site. Turning off the browser's cookies will prevent
Web beacons from tracking the user's activity. The Web beacon will still account for an
anonymous visit, but the user's unique information will not be recorded.

Internet Protocol (IP) Address - an Internet Protocol (IP) Address is associated with your
computer's connection to the internet. SFSC may use your IP address to help diagnose problems
with SFSCs server, to administer the Website and to maintain contact with you as you navigate
through the Website. Your computer's IP address also may be used to provide you with
information based upon your navigation through the Website. SFSC does not link IP addresses to
any Personal Information.
Aggregate Information is used to measure the visitors interest in, and use of, various areas of
the Website and the various programs that SFSC administers, SFSC will rely upon aggregate
information, which is information that does not identify you, such as statistical and navigational
information. With this aggregate information, SFSC may undertake statistical and other summary
analyses of the visitors' behaviors and characteristics. Although SFSC may share this aggregate
information with third parties, none of this information will allow anyone to identify you, or to
determine anything else personal about you.
8. Compliance with the Digital Advertising Alliance
The SUBWAY Group uses the Evidon assurance platform to comply with the cross-industry
Self-Regulatory Program for Online Behavioral Advertising as managed by the Digital Advertising
Alliance (DAA) (http:///aboutads.info). As part of this service, the SUBWAY Groups online
advertisements and Web sites are sometimes delivered with icons that help consumers
understand how their data is being used and provide choice options to consumers that want more
control. The list of our advertising partners may be updated from time to time. To opt-out of
internet-based advertising by all DAA-participating companies, please visit
http://www.aboutads.info/choices/.
9. Interest-Based/Online Behavioral Advertising
On some pages of our site we may allow third-party advertising partners to set web tracking tools
(e.g., cookies and web beacons) to collect anonymous, non-personally identifiable information
regarding your activities on those pages (e.g., your IP address, page(s) visited, time of day). We
may also share such information we have collected with third-party advertising partners. These
advertising partners may use this information (and similar information collected from other
websites) for purposes of delivering future targeted advertisements to you when you visit other
(non-SUBWAY) sites within their networks. This practice is commonly referred to as "interestbased advertising" or "online behavioral advertising."
Pages of our website that collect information that may be used by such advertising partners for
interest-based advertising purposes may be identified by a link to AdChoices on the page.
Opting out (site pages). If you do not want your browsing while on such pages to be used for
interest-based advertising purposes, you may click on the AdChoices link to opt-out of such uses
by the listed advertising partner(s). Even if you opt-out through this service, we may still collect
non-personally identifiable information regarding your site activities and use it for non-interestbased advertising purposes as described in this privacy statement.
Opting out (advertisements). Advertisements on third-party sites that contain the AdChoices link
and that link to this Privacy Statement may have been directed to you based on anonymous, nonpersonally identifiable information collected by advertising partners over time and across
websites. These advertisements provide a mechanism to opt-out of the advertising partners' use
of this information for interest-based advertising purposes. Even if you opt-out through this
service, we may still collect and use information from the advertisements for non-interest based
advertising purposes, such as to determine the effectiveness of the advertisements.

10. Do Not Track

Do Not Track (DNT) is a privacy preference that users can set in certain web browsers. DNT is
a way for users to inform websites and services that they do not want certain information about
their webpage visits collected over time and across websites or online services. We are
committed to providing you with meaningful choices about the information collected on our
website for third party purposes, and that is why we provide the DAA opt-out link above.
However, we do not recognize or respond to browser-initiated DNT signals, as the Internet
industry is currently still working toward defining exactly what DNT means, what it means to
comply with DNT, and a common approach to responding to DNT. To find out more about "Do
Not Track," you may wish to visit http://www.allaboutdnt.com.
11. SFSCs Collection of Personal Information Regarding Children.
This website is not targeted towards people who have not reached their age of majority for
your geographical area. The age of which a person is no longer considered a minor varies
from country to country. If you are unsure of the age of majority is for your country,
please check with an adult to find out if you may still be considered a minor. SFSC does
understand that a minor may still try to contact SFSC and in so doing may voluntarily
provide SFSC Personal Information. If you are a minor under the age of majority, PLEASE
DO NOT submit any Personal Information about yourself on this website WITHOUT
GETTING PERMISSION FROM YOUR PARENT(S) OR GUARDIAN(S) FIRST.
Childrens privacy is very important SFSC. SFSC an affiliate of the SUBWAY Group, whose
servers are located in the United States, adheres to the United States Children's Online Privacy
Protection Act (COPPA). The Federal Trade Commission (FTC) has the authority to issue
regulations and enforce COPPA, which applies to websites and online services operated for
commercial purposes that are directed at, and are collecting Personal Information from children
under thirteen (13) years of age. COPPA explains what a website operator must include in their
Privacy Statement, what responsibilities a website operator has to protect children's privacy and
safety online, including restrictions on marketing to those under thirteen (13) years of age, it also
requires that we inform parents and/or legal guardians how we collect, use, and disclose
Personal Information from children under thirteen (13) years of age, as well as, how to obtain
verifiable consent from a parent in order for children to use certain features of on a website.
SFSC will not knowingly allow anyone under thirteen (13) years of age to provide us with any
Personal Information about themselves (such as their names, e-mail address, and phone
number) over the Internet. If a child has provided SFSC with Personal Information without the
consent of a parent, we ask the parent of that child to contact SFSCs Privacy Officer immediately
at: privacyofficer_ca@subway.com. We will use all reasonable efforts to promptly delete the
child's Personal Information from our servers. Please note, that when we use the term "parent",
we mean to include legal guardians.
12. Collection and Use of Employee Personal Information
Personal Information collected from employees and applicants is limited to administration of
Human Resources programs and functions, which include, but are not limited to: job applications
and hiring programs, compensation and benefit programs, performance appraisals, training,
access to SFSC and its affiliates facilities and computer networks, employee profiles, internal
intranet employee directories, Human Resource recordkeeping, and other employment related
purposes.
It is the policy of SFSC to keep all past and present employee information private from disclosure
to third parties, accept for where there are certain business related exceptions, such as:
1. To comply with county, state or federal agency requests;

2. Inquiries from third parties with a signed authorization from the employee to release the
information, except in situations where limited verbal verifications are acceptable (see
below);
3. Third parties with which SFSC has contractual agreements to assist in administration of
company sponsored benefits.
Please note that this Privacy Statement does not apply to SUBWAY restaurant employment
applications submitted through the website, which may be shared with independently-owned and
operated franchises who are seeking employees in their market area.
13. Verifications of Employment
Prospective employers, state agencies, financial institutions, and residential property managers
routinely contact SFSC requesting information on a former or current employee's work history
and salary. All such requests of this type shall be referred to and completed on a confidential
basis by the Human Resources Department or Payroll Department.
For written verification of employment requests, information will be provided on the form only
when it is accompanied by an employee's signed authorization to release information. The form
will be returned directly to the requesting party and filed as part of the Human Resources or
Payroll Departments confidential records.
14. Collection and Use of SUBWAY Franchisee and Prospective Franchisee Personal
Information
If you choose to, you may submit via: www.subway.com an electronic application seeking
consideration as a prospective SUBWAY franchisee. By submitting an electronic application,
you agree that we may disclose your Personal Information to our affiliates within the SUBWAY
Group, the FAF Group, SUBWAY DAs, and third party service providers as part of their
consideration to your inquiry and to help them conduct their franchise marketing efforts. Personal
Information collected from prospective franchisees include, but is not limited to: name, address,
telephone number, facsimile number, email address, date of birth, citizenship, educational
background, criminal background, bank account information for Electronic Funds Transfer,
financial statement, litigation history, and taxpayer identification number. Information on your
online form will become part of an application for a franchise that you might later submit. We
require our affiliates within the SUBWAY Group, the FAF Group, and SUBWAY DAs to
respect SFSCs privacy practices and not use your Personal Information for purposes other than
to carry out our instructions.
Any potential franchisee Personal Information sent to: www.subway.com is stored on a server
located in the United States. The server is managed by FWH, based in the United States.
Information on this server may be shared with:

DAI, the owner and licensor of the SUBWAY system, based in Milford, Connecticut,
USA.
FWH, which operates as a service-oriented company for and on behalf of the SUBWAY
System worldwide by providing core business related services, based in Milford,
Connecticut, USA. Relevant DAs for your geographical area.
Subway Real Estate, LLC (SRE), based in Milford, Connecticut, USA, as well as its
leasing affiliates for your geographical area.

SFSC and its affiliates will retain your Personal Information only for as long as necessary to fulfil
the purpose(s) for which it was collected and to comply with applicable laws. Your consent to
such purpose(s) remains valid after termination of our relationship with you.

Website - www.subway.com is hosted on a web server located in the United States of America.
The content of: www.subway.com, including updates to the consumer content, is managed by
FWH. When you click on the links for Contact Us, Request a Brochure, Own a Franchise, and
Submit a Site, where you fill out and submit a form which goes directly to SUBWAY
Headquarters database, located in Milford, Connecticut, USA. The domain name subway.com is
owned by Doctor's Associates Inc.
Finally, upon becoming a SUBWAY franchisee you consent to SFSC disclosing former or past
franchisee contact information including Personal Information in its Disclosure Document for one
(1) year after leaving the system, as required by law, unless you advise otherwise. Contact
SFSCs Privacy Officer at: privacyofficer_ca@subway.com, in writing, either by email or regular
mail, of your desire to not have your details or contact information disclosed, corrected or
changed when you sell or transfer your SUBWAY store, or exit the SUBWAY system (whether
by termination or otherwise). Please see the section provided below entitled SFSC Privacy
Officer Contact Information to find the physical address for SFSCs Privacy Officer.
15. Collection and Use of Development Agent Personal Information
By applying to become a SUBWAY DA via: www.subway.com an applicant consents to the
collection, use, and disclosure of Personal Information in accordance with the following terms and
conditions. We collect and use Personal Information in order to assist you in applying, and
evaluating you to become a SUBWAY DA. Personal Information is collected to assist SFSC and
its affiliates within the SUBWAY Group in selecting DA candidates and for the purpose of
operating a development territory.
Personal Information collected includes, but is not limited to: name, home address, home
telephone number, facsimile number, email address, date of birth, bank account information for
Electronic Funds Transfer, financial statement, resume, taxpayer identification number and
background checks. Once a DA candidate becomes a DA, they may then reference themselves
by their DA Number. Failure to provide necessary information may negatively impact your ability
to become a DA.
Finally, as a DA within the SUBWAY Group certain business information with respect to stores
within your territory may be shared in the aggregate amongst your DA community. Such business
information may include, but is not limited to: three (3) year DA Performance Report, Emerging
Market Developing Activity Report, Developed Market Report, Subway Compared to other QSR
Report, and the Weekly Same Store AUV and Units Report.
16. Mobile Information
You may submit Personal Information via your cell phone, smartphone, and tablet. If you use any
location-enabled products, you may be sending us location information. SFSC does not store or
use this information other than to provide the service you requested. For example, a mobile
product may use GPS data to find a nearby restaurant you requested. Location-enabled features
are opt-in and you have control over your participation and can turn these services off at any
time.
SFSC uses a variety of new technologies and social media options to communicate and interact
with consumers. These websites and mobile applications include popular social networking and
media sites, such as, Twitter and Facebook. If you post updates to or receive updates from
www.twitter.com, www.facebook.com, and other social networking websites, during the
Promotion Period via SMS from your wireless phone, your wireless-service provider may charge
you for each text message you send and receive. You must consult your wireless service provider
regarding its pricing plans, as rates may vary. Use of third party social networking websites, such

as, Twitter and Facebook, are governed by the privacy practices of those websites. SFSC does
not capture or store your login information or any other personally identifiable information for
Twitter, Facebook, and other social networks, however, session information or cookies may be
stored on your wireless phone, by their websites.
Mobile Information We Collect

Web-enabled mobile applications may use cookies or web beacons and other methods to
customize your browsing experience. Please see SFSC's website Privacy Statement for
more information.
Some mobile applications will utilize Google Analytics (or similar tool) to help us better
serve our customers through improved products, services, and revisions to the mobile
applications. This collected information will not identify you to SFSC. It may, however, let
us know anonymously, which services and features you are using the most within the
application, as well as device type and hardware features, country and language of
download.
Use of 3rd party services such as social sharing sites (e.g., Facebook and Twitter) is
governed by the privacy practices of those services. SFSC does not capture or store your
login information or other Personal Information for these services, however session info
or cookies may be stored.

Mobile Information Sharing

SFSC does not share any collected information with 3rd parties with the following
exceptions:
SFSC may provide some personal data to third-party partners that are providing services
essential to your mobile user experience.
All requests are sent through your mobile carrier's network and your carrier may have
access to it. Consult your carrier's privacy policies for additional information.
Certain mobile products and services and manufacturers allow you to interact and share
your information with others. For example, you may want to Tweet or post to your
Facebook page content from a SFSC mobile application. Consult your mobile device
manufacturer, or mobile product or application developer's privacy policies for additional
information.

17. Mobile Marketing Promotions and Advertising

If you participate in any advertising or marketing promotions the information that you provide will
be handled in accordance with the Privacy Statement specific to said promotion which cannot and
does not apply to this Privacy Statement.
Wireless Promotional Opportunities - SFSC may provide users and viewers with the opportunity
to register for special promotions via mobile text messaging and other wireless devices. Users
are required to provide their consent to receive such information from SFSC, either by registering
on our website or via your wireless device. Promotional opportunities may be provided by the
SUBWAY Group, the FAF Group, and/or SFSCs third-party service providers. The Personal
Information requested as part of the online registration process may include, but is not limited to,
a user's telephone number or a wireless email address (only if specifically requested), and your
mobile carrier's name.
Please note that most wireless transmissions are not secured and there is a greater risk of an
unknown third party's interception of messages or a user's Personal Information when using a
wireless communications device.

Users that register for wireless services acknowledge, understand and agree that they may be
charged by the user's wireless carrier for all messages between SFSC and the user. Standard
messaging rates will apply, unless noted otherwise. Under no circumstances will our website,
SFSC, the SUBWAY Group, the FAF Group, or its affiliates be held responsible for any wireless
email or text messaging charges incurred by a user or by a person that has access to a user's
wireless device, telephone number, or email address.
Termination of Wireless Services by User - Users may revoke their consent to receive mobile
messages for marketing promotions from SFSC and/or its affiliates by the following procedure:
A user may cancel one or more services via his/her wireless device at any time by using the
unsubscribe mechanism provided by SFSC at the time the message is sent, or by sending a text
message that says "STOP", "END", "CANCEL", "REMOVE", "UNSUBSCRIBE" or "QUIT".
SFSC will terminate the user's registration for the most recent wireless service sent to the user.
Any of these words followed by the word "ALL" in the user's termination request will cancel all of
the user's registered wireless services with SFSC. If the user unsubscribes from one or all of
SFSC service(s) via his or her wireless device, the service(s) will be terminated immediately and
will cancel the user's previous opt-in.
Use of Information - SFSC will not use a wireless telephone number, wireless or conventional
internet email address, or other Information submitted for its wireless marketing promotions for
any other purpose than to provide the services requested, unless we provide to you advance
notice of any other use. We will not share any Personal Information with third party service
providers unless you opt-in for such disclosure.
18. Forward-To-A-Friend and Refer-A-Friend
You may use a referral feature (either on a web page, in an e-mail, from a banner ad or other
communication) to inform a friend about a SFSC web page or promotion. SFSC may use any email address provided when using this referral feature to send both an initial e-mail and a
subsequent e-mail to recipients about the particular promotion, product, or service in which you
indicated your "friend" may have an interest.
19. Opt-Out of Email Updates
You may have the opportunity to elect to receive email communications from SFSC. SFSC will
only email you if you elect to receive them. If you elect to receive email communications, SFSC
will send you occasional updates about new additions to the Website as well as special offers and
promotions of which you can take advantage. If at any time you decide you would rather not
receive these types of communications from SFSC, you can opt-out by clicking the unsubscribe
link at the bottom of any SFSC email, update the contact preferences for your account, or contact
SFSCs Privacy Officer at:privacyofficer_ca@subway.com .
20. Sharing of Personal Information
SFSC does not sell Personal Information to third-parties. We may share Personal Information
with our service providers, consultants and affiliates for our internal business purposes. Except
as described in this Privacy Statement, SFSC will not share Personal Information with a third
party, unless a customer requests, consents to such disclosure, or disclosure is required or
authorized by law.
We may share your Personal Information with agents, affiliates or service providers who act for or
on behalf of SFSC in connection with the business of SFSC, or for further processing the data in
accordance with the purpose(s) for which the data was originally collected, e.g., third party
maintenance of secure listing databases. We require our agents, affiliates and service providers

to agree in writing to maintain the confidentiality and security of Personal Information they
maintain on behalf of SFSC and not to use it for any purpose other than the purpose for which we
retained them. We also require any third parties we retain to protect Personal Information
disclosed by us in accordance with all applicable privacy requirements and the general privacy
principles described in this Privacy Statement.
The Personal Information you provide SFSC is considered a company asset and may be
disclosed and/or transferred to a third party in the event of a proposed or actual purchase, sale,
lease, merger, amalgamation or any other type of acquisition, disposal, or financing of all or any
portion of SFSC or of any of the business assets or shares of SFSC or a division thereof, in order
for a customer to continue to receive the same products and services from the third party.
Although we make every effort to preserve user privacy, we reserve the right to disclose Personal
Information to a third party in certain limited circumstances, specifically: to comply with a law,
regulation, search warrant, subpoena, judicial proceeding, a court order, or as otherwise may be
required by law, to enforce our policies or contracts, to collect amounts owed to us, to protect
users of our sites from fraudulent or abusive use, during emergencies when safety is at risk, as
determined by SFSC, or otherwise where necessary for the establishment, exercise or defense of
legal claims. In addition, from time to time, server logs may be reviewed for security purposes;
for example, to detect unauthorized activity on the web site. In such cases, server log data,
containing IP addresses, would be shared with law enforcement bodies in order that they may
identify users in connection with their investigation of the unauthorized activities.
As described above, SFSC, its affiliates within the SUBWAY Group, third party service
providers and SUBWAY DAs may share and exchange Personal Information in order to
process franchisee applications, administer the SUBWAY franchise system, and protect the
integrity of the SUBWAY franchise system and trademarks. Personal Information may be
provided to a courier or freight forwarder in order to fulfill an order, which may have been
requested from us.
SUBWAY DAs and other service providers are prohibited from using Personal Information for
any purpose other than to provide assistance to SFSC and its affiliates within the SUBWAY
Group. SUBWAY DAs are required to protect Personal Information disclosed by us and to
comply with the general privacy principles described in this Privacy Statement.
21. Security
We endeavor to protect your Personal Information using physical, electronic or procedural
security measures appropriate to the sensitivity of the information in our control. We safeguard
your Personal Information on the Internet by using industry-standard practices. Although
"guaranteed security" does not exist either on or off the Internet, we make commercially
reasonable efforts to make the collection and security of such information consistent with our
Privacy Statement and all applicable laws and regulations.
Currently, our website utilizes a variety of different security measures designed to protect
Personal Information by users both inside and outside SFSC, including the use of encryption
mechanisms (e.g., Secure Socket Layers or SSLs), password protection, and other security
measures to help prevent unauthorized access to your Personal Information. This helps maintain
the confidentiality, privacy, and integrity of your transactions, and helps to protect your
confidential information - such as credit card numbers, online forms and financial data, from loss,
misuse, interception and hacking.
Phishing- Identity theft and the practice currently known as phishing are of great concern to
SFSC. Accordingly, safeguarding information to help protect you from identity theft is a top

priority. We do not and will not, at any time, request your credit card information, your account
ID, login password, Social Security Number or National Identification numbers in a non-secure or
unsolicited e-mail or telephone communication. For more information about phishing, visit the
Federal Trade Commissions website at: http://www.consumer.ftc.gov/articles/0003-phishing.
22. Storage, Retention, and Accuracy of Personal Information
All reasonable steps are taken to safeguard your Personal Information against loss, unauthorized
access, use, modification, disclosure. or any other misuse. SFSC takes all reasonable steps to
insure that your Personal Information is accurate, up-to-date, complete, relevant and not
misleading. SFSC will retain your Personal Information only for as long as necessary to fulfill the
purpose(s) for which it was collected and to comply with applicable laws. Your consent to such
purpose(s) remains valid after termination of our relationship with you.
SFSC may store your Personal Information in its databases located outside of the United States.
Additionally, some of our service providers may be located in the United States and its territories,
Canada and its provinces, the European Economic Area (EEA), or other countries outside of the
EEA and may be subject to the laws of the local jurisdiction. As a result, in certain circumstances,
the United States and its territories, Canada and its provinces, the EEA, and other foreign
governments, courts, law enforcement agencies or regulatory agencies may be entitled to access
the Personal Information collected and held by SFSC.
23. Access, Control, and Update Personal Information
You may contact SFSCs Privacy Officer to access, correct, or delete your Personal Information.
If necessary, SFSCs Privacy Officer will contact another individual to assist in completing your
requested task. SFSC wants to be sure that we keep only the most accurate and up-to-date
Personal Information about you in our records. You can email SFSCs Privacy Officer at:
privacyofficer_ca@subway.com, to update your contact information. To protect your privacy, we
will take all reasonable steps to help verify your identity before granting access or making any
changes to your Personal Information.
24. SFSC Privacy Officer Contact Information
If you have any questions or concerns, please contact SFSCs Privacy Officer at:
SFSC Privacy Officer
c/o Franchise World Headquarters, LLC
325 Bic Drive
Milford, CT, 06461
USA
Telephone Number:
(203) 877-4281 or Toll Free: 1-800-888-4848
Facsimile:
(203) 783-7479
Email Address:
We will address your concern and attempt to resolve any problem. Download Privacy Information
Request Form here: http://www.subway.com/subwayroot/InfoRequestForm.pdf.
25. Links to Non-SFSC Websites and Third-Parties
Please note that: www.subway.com website may contain links to other websites for your
convenience and information. SFSC does not control those websites or their privacy practices,
which may differ from: www.subway.com. SFSCs Privacy Statement cannot and does not apply
to external websites. We do not endorse or make any representations about third-party websites.

The Personal Information you choose to give to unrelated third-parties is not covered by the
SFSC Privacy Statement. We encourage you to review the Privacy Policy of any company or
website before submitting your Personal Information. Some third-parties may choose to share
their personal data with SFSC; that sharing is governed by that third-party companys Privacy
Policy, not, SFSCs Privacy Statement.
26. Social Media and Online Engagement
The SUBWAY Group, use a variety of new technologies and social media options to
communicate and interact with consumers. These sites and applications include popular social
networking and media sites, open source software communities and more. To better engage the
public in ongoing dialog, the SUBWAY Group uses several third-party platforms including, but
not limited to, Facebook, Twitter, and YouTube. Third-Party Websites and Applications (TPWA)
are Web-based technologies that are not exclusively operated or controlled by the SUBWAY
Group. When interacting with the SUBWAY Group presence on those websites, you may
reveal certain Personal Information to the SUBWAY Group or to third parties. Except when
used by the SUBWAY Group employees for the purpose of responding to a specific message
or request, the SUBWAY Group will not use, share, or retain your Personal Information.
At this time, the SUBWAY Group has three (3) Social Media Accounts,
https://www.facebook.com/subway, https://twitter.com/subway, and
http://www.youtube.com/subway.
Facebook: On the https://www.facebook.com/subway Facebook page, the SUBWAY Group
staff posts news and other items of interest to individuals. If you have a Facebook account or
'Like' https://www.facebook.com/subway the SUBWAY Groups Facebook page, you can post
comments or click on the 'like' option for individual entries. If you comment or click on the 'like'
button, personally identifying information will be visible to the SUBWAY Group staff and other
Facebook site visitors. The amount of visible Personal Information will depend on your own
Facebook privacy settings. You can completely avoid displaying any personally identifiable
information by not creating an account, not posting comments and not clicking on the 'like' options
in Facebook. the SUBWAY Group staff does not collect, use or disclose any information about
visitors who comment or 'like' the SUBWAY Facebook site. Facebook collects and reports on
non-personally identifiable information about activities on Facebook pages. This information is
password protected and only available to the SUBWAY Group employees, members of the
SUBWAY Communications and Web Teams, and other designated staff who require this
information to perform their duties. The Facebook Privacy Policy is available at:
http://www.facebook.com/about/privacy/.
Twitter: The SUBWAY Group uses Twitter to send short messages (up to 140 characters) or
'Tweets' to share information about SUBWAY Restaurants with visitors and respond to
comments and inquiries sent via our Twitter account: @SUBWAY. While visitors may read the
SUBWAY Group Twitter feeds without subscribing to them, visitors who want to subscribe to (or
follow) the SUBWAY Group Twitter feeds must create a Twitter account at www.twitter.com. To
create an account, you must provide some Personal Information, such as name, user name,
password and email address. Visitors have the option to provide additional Personal Information
including a short biography, location or a picture. Most information you provide for a Twitter
account is available to the public, but you can modify how much of your Personal Information is
visible by changing your privacy settings at the Twitter.com website. The SUBWAY Group staff
members monitor the number of subscribers and respond to comments and queries via Twitter,
but the staff never takes possession of the Personal Information belonging to Twitter followers.
The SUBWAY Group does not collect, maintain, disclose or share any Personal Information
about people who follow SUBWAY on Twitter. The Twitter Privacy Policy is available at:
http://twitter.com/privacy.

YouTube: The SUBWAY Group posts videos on YouTube to make them available to all
SUBWAY visitors. You do not need to register with either YouTube or Google (YouTube owner)
to watch SUBWAY videos. When visitors watch videos, YouTube may record non-personally
identifiable information about its site usage, such as channels used, videos watched, and data
transfer details to improve its services. If you log on to the YouTube site before watching
SUBWAY videos, YouTube may associate information about your site use with your YouTube
account. If you log on to YouTube and comment on any SUBWAY videos, any Personal
Information you included when registering for your account will be visible to visitors who click on
the comment. If you do not log in before watching SUBWAY videos posted on YouTube, your
site use will not be associated with you or a YouTube account. The YouTube Privacy Policy is
available at: http://www.youtube.com/t/privacy.
SUBWAY Franchisees may have the opportunity to sponsor their own Facebook Pages, Twitter
Accounts, and Youtube Accounts. Please note, the Privacy Policies of the individual SUBWAY
Franchisees social media pages are located on the individual SUBWAY Franchisees websites.
This Privacy Statement does not govern the Personal Information handling practices and
procedures of individual SUBWAY Franchisees social media pages and their individual
websites.
27. Your California Privacy Rights (As provided by California Civil Code Section 1798.83)
A California resident who has provided Personal Information to a business with whom he/she has
established a business relationship for personal, family, or household purposes ("California
customer") is entitled to request information about whether the business has disclosed Personal
Information to any third parties for the third parties' direct marketing purposes. In general, if the
business has made such a disclosure of Personal Information, upon receipt of a request by a
California customer, the business is required to provide a list of all third parties to whom Personal
Information was disclosed in the preceding calendar year, as well as a list of the categories of
Personal Information that were disclosed. However, under the law, a business is not required to
provide the above-described lists if the business adopts and discloses to the public (in its Privacy
Statement) a policy of not disclosing customer's Personal Information to third parties for their
direct marketing purposes unless the customer first affirmatively agrees to the disclosure, as long
as the business maintains and discloses this policy. Rather, the business may comply with the
law by notifying the customer of his or her right to prevent disclosure of Personal Information and
providing a cost free means to exercise that right.
28. U.S. EU and the U.S. - Swiss Safe Harbor Compliance
FWH and DAI, affiliates of SFSC, are in compliance with the U.S. Department of Commerce Safe
Harbor requirements regarding the transfer of Personal Information from the European Economic
Area (EEA) or Switzerland to the United States. FWH has been Self-Certified under the Safe
Harbor privacy frameworks as set forth by the U.S. Department of Commerce, European
Commission and Federal Data Protection and Information Commissioner of Switzerland
regarding the collection, storage, use, transfer and other processing of personal data transferred
from the European Economic Area or Switzerland to the U.S., in accordance with Directive
95/46/EC of the European Parliament, and the Swiss Federal Act on Data Protection (FADP)
effective July 1993, modified January 2008. Organizations that Self-Certify under Safe Harbor
must comply with the U.S. EU and the U.S. - Swiss Safe Harbor Frameworks Privacy
Principles which are:

Notice - Individuals must be informed that their data is being collected and about how it
will be used;
Choice - Individuals must have the ability to opt out of the collection and forward transfer
of the data to third parties;

Onward Transfer (Transfers to Third Parties) - Transfers of data to third parties may
only occur to other organizations that follow adequate data protection principles;
Security - Reasonable efforts must be made to prevent loss of collected information;
Data Integrity - Data must be relevant and reliable for the purpose for which it was
collected;
Access - Individuals must be able to access information held about them, and correct or
delete it if it is inaccurate;
Enforcement - There must be effective means of enforcing these rules.

Further information regarding the Safe Harbor Frameworks privacy principles and certification
process can be found at: www.export.gov/safeharbor.
In addition, the U.S. Department of Commerce maintains lists of compliant organizations (i.e., the
U.S.-EU Safe Harbor List and the U.S.-Swiss Safe Harbor List), which can be accessed at:
http://safeharbor.export.gov/list.aspx and https://safeharbor.export.gov/swisslist.aspx.
SFSC uses a self-assessment approach to assure compliance with this Privacy Statement and
periodically verifies that this Privacy Statement is accurate, easily accessible, prominently
displayed, abides by, and contains the information intended to be covered by the Safe Harbor
Frameworks, as stated above.
If you are a resident of the European Economic Area (EEA) or Switzerland and have any
questions, concerns, or complaints, regarding SFSCs use or disclosure of your Personal
Information, and compliance with the Safe Harbor Frameworks, please contact FWHs designated
Privacy Officer at: privacyofficer_ca@subway.com. SFSCs Privacy Officer will investigate and
attempt to resolve any complaints or disputes regarding the use and disclosure of your Personal
Information, in compliance with any applicable Data Protection Laws, which may be required by
various local, state, federal, or international laws, regarding any and all websites operated by and
on behalf of SFSC.
If a complaint or dispute cannot be resolved through SFSCs internal process, SFSC has agreed
to participate in the dispute resolution procedures established by the EU Data Protection
Authorities (DPAs) to resolve disputes pursuant to the U.S. EU Safe Harbor Privacy Principles
in respect to Personal Information received from the EEA. SFSC has also agreed to cooperate
and comply with any advice given by the Information Commissioner of Switzerland in the:
investigation and resolution of complaints brought under the U.S. Swiss Safe Harbor Privacy
Principles. The EU DPAs panel may be contacted at:
ec-dppanel-secr@ec.europa.eu and the EU DPAs may be contacted directly via the information
provided at: http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm. The
contact information for the Swiss FDPIC can be found
at: http://www.edoeb.admin.ch/kontakt/index.html?lang=en.
29. Residents of the European Union, European Economic Area, and Switzerland
If you are a resident of the European Economic Area (EEA) or Switzerland and have any
concerns or complaints, please first address these issues to SFSCs Privacy Officer, as provided
in the above section entitled SFSC Privacy Officer Contact Information.
30. International Privacy Statements
SFSC, encourages you to view your countrys Privacy Statement at: www.subway.com. To view
your countrys Privacy Statement please go to:
http://www.subway.com/subwayroot/exploreourworld.aspx. At the top of the page, please click on
CHANGE, which brings you the EXPLORE OUR WORLD page. To choose your Country click on
the Country name, then go to the very bottom of the Countrys page and click the PRIVACY
STATEMENT link to view the website Privacy Statement specific to your Country.

31. Changes to SFSCs Privacy Statement

SFSC will update this Privacy Statement occasionally. When SFSC posts changes to this Privacy
Statement, we will also revise the "LAST REVIEWED" date on SFSCs Privacy Statement. If
there are any material changes to this Privacy Statement, SFSC will notify you by email, or by
means of a notice on our home page. SFSC encourages you to review this Privacy Statement
periodically to be informed of how SFSC is protecting your Personal Information and to be aware
of any changes to SFSCs Privacy Statement. Your continued use of the website after the posting
of any amended Privacy Statement shall constitute your agreement to be bound by any such
changes. This Privacy Statement is incorporated into any Terms and Conditions governing the
various websites and any programs or services operated or managed on or behalf of SFSC. Any
changes to this Privacy Statement are effective immediately after being posted by SFSC.
32. Terms and Conditions of Website Use
The Terms and Conditions located at: http://www.subway.com/subwayroot/legalDisclaimer.aspx,
govern your use of the SUBWAY Groups website: www.subway.com. The provisions therein
apply to any disputes that may arise in relation to this Privacy Statement and the collection, use
and disclosure of your Personal Information, and are of the same force and effect as if they had
been reproduced directly in this Privacy Statement.