What laws must a Face Foundrie franchisee comply with?

or approved remodeling plans in connection with the Premises, or the design thereof, or any of the materials used therein, or their colors, without the express written approval of Franchisor, except that Franchisee will, upon request of Franchisor, make such reasonable alterations to the Facial Bar or premises as may be necessary to conform to the then-current marketing and operating standards and specifications of the System. Franchisee will paint the Facial Bar (interior or exterior) at such intervals as Franchisor may reasonably determine to be advisable, which determination shall in no event be more than once in any calendar year.

• (d) Comply with all applicable laws, rules, ordinances, regulations and licensing and permitting requirements that affect or otherwise concern the Facial Bar or the Premises, including, without limitation, zoning, disability access, signage, fire and safety, sales tax registration, music licensing, health and sanitation, construction, HVAC, plumbing, environmental laws, and other data privacy regulations, guidelines and best practices. Franchisee will be solely responsible for obtaining any and all licenses and permits required to operate the Facial Bar. Franchisee must comply with all state and local laws and regulations regarding the staffing and management of the Facial Bar, including without limitation (i) any requirements for medical personnel supervision, ownership, oversight or involvement with the Facial Bar, and (ii) any requirements for certain services to be provided by licensed and/or credentialed individuals. Without limiting the previous

sentence, Franchisee must ensure each employee or contractor has all necessary licenses, and meets all continuing education requirements, and Franchisee must maintain copies of all such licenses. Franchisee must notify Franchisor in writing within five (5) days of the commencement of any action, disciplinary investigation, suit, proceeding or investigation, or of the issuance of any order, injunction, award of decree, by any court, agency, or other governmental instrumentality that relates to Franchisee, the Facial Bar, or any of Franchisee's employees. Franchisee must keep copies of all health, fire, building occupancy and similar inspection reports on file and available for Franchisor to review. Franchisee must promptly forward to Franchisor any correspondence stating that Franchisee is not in compliance with any such laws, rules, ordinances and regulations. Franchisee must abide by: (a) the Payment Card Industry Data Security Standards ("PCIDSS") enacted by the applicable Card Associations (as they may be modified from time to time or as successor standards are adopted); (b) the Fair and Accurate Credit Transactions Act ("FACTA"); and (c) all other standards, laws, rules, regulations or any equivalent thereof applicable to electronic payments that may be published from time to time by payment card companies and applicable to electronic payments ("Electronic Payment Requirements"). If Franchisee or Franchisor are required by one of the credit card companies or another third party (including any governmental body) to provide evidence of compliance with PCIDSS, FACTA or applicable Electronic Payment Requirements, Franchisor may require Franchisee to provide, or make available, to Franchisor copies of an audit, scanning results, or related documentation relating to such compliance. If Franchisee suspects or knows of a security breach, Franchisee must immediately give Franchisor notice of such security breach and promptly identify and remediate the source of any compromise or security breach. Franchisee assumes all responsibility for providing all notices of breach or compromise and all duties to monitor credit histories and transaction concerning customers of the Facial Bar.

Source: Item 22 — CONTRACTS (FDD pages 73–74)