SUKI PLATFORM — END-USER PLATFORM AGREEMENT AND GENERAL PRIVACY POLICY

(For Customer/End-User Onboarding — Document 2 of 3)

EFFECTIVE DATE: The date on which the individual user completes the SUKI Platform customer registration process and affirmatively indicates acceptance of these terms through the SUKI Platform's digital acceptance mechanism (the "Effective Date of User Acceptance").

PARTIES AND SCOPE

This End-User Platform Agreement and General Privacy Policy (hereinafter referred to as the "User Agreement," the "End-User Agreement," or the "EUPA") is entered into by and between:

SUKI PLATFORM OPERATIONS (hereinafter referred to as "SUKI," the "Platform," the "Company," or "We," "Us," or "Our"), a business entity duly organized and operating under the laws of the Republic of the Philippines; and

THE END-USER (hereinafter referred to as the "User," "Customer," "You," or "Your"), being the individual natural person who has completed or is in the process of completing the SUKI Platform customer registration process.

This User Agreement governs Your access to and use of the SUKI multi-merchant digital loyalty Progressive Web Application platform, all associated features and functionalities, and all related services provided by SUKI to You as an end-user customer. This User Agreement applies to Your use of the SUKI Platform generally, prior to and independently of Your enrollment in any specific Merchant's loyalty program, which enrollment is separately governed by the Merchant-Specific Loyalty Terms and Data Waiver (Document 3).

PLEASE READ THIS USER AGREEMENT IN ITS ENTIRETY AND CAREFULLY BEFORE ACCESSING OR USING THE SUKI PLATFORM. BY REGISTERING AN ACCOUNT ON THE SUKI PLATFORM, OR BY ACCESSING OR USING THE SUKI PLATFORM IN ANY MANNER WHATSOEVER, YOU UNCONDITIONALLY ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREED TO BE LEGALLY BOUND BY EVERY TERM, CONDITION, CLAUSE, PROVISION, LIMITATION, DISCLAIMER, AND OBLIGATION SET FORTH IN THIS USER AGREEMENT. IF YOU DO NOT AGREE TO THESE TERMS IN THEIR ENTIRETY, YOU MUST IMMEDIATELY CEASE ALL USE OF THE SUKI PLATFORM AND CLOSE YOUR ACCOUNT.

PART ONE: PLATFORM TERMS OF USE

ARTICLE 1 — DEFINITIONS

For all purposes of this User Agreement, the following terms shall have the meanings ascribed to them herein, in addition to any definitions set forth in the SUKI Master Subscription and Platform Agreement (Document 1), which definitions are incorporated herein by reference to the extent applicable to end-users:

Section 1.01 — "Account" shall mean the unique user profile and associated account created by and for You on the SUKI Platform upon the completion of the registration process, through which You access the SUKI Platform and all features thereof.

Section 1.02 — "Account Credentials" shall mean the combination of Your registered email address (or mobile phone number, as applicable), password, one-time passwords (OTPs), and any other authentication information used to access Your Account.

Section 1.03 — "Browser Cache" shall mean the temporary storage area within Your web browser where static resources (including web application assets, scripts, and stylesheets associated with the SUKI Platform) may be locally stored on Your Device to improve the performance and functionality of the SUKI Platform PWA during subsequent visits.

Section 1.04 — "Device" shall mean any smartphone, tablet, personal computer, laptop, smart television, or other computing device through which You access the SUKI Platform via a compatible web browser.

Section 1.05 — "Digital Assets" shall mean all digital stamps, reward credits, loyalty points, redeemable vouchers, referral stamps, promotional credits, and other digital value tokens of any kind accumulated in Your Account or in any Merchant sub-account linked to Your Account through the SUKI Platform, as further described in the applicable Merchant-Specific Loyalty Terms and Data Waiver (Document 3).

Section 1.06 — "Enrolled Merchant" shall mean any Merchant whose specific loyalty program You have joined by executing the Merchant-Specific Loyalty Terms and Data Waiver (Document 3).

Section 1.07 — "Local Storage" shall mean the web storage mechanism (including the Web Storage API's localStorage and sessionStorage interfaces, as well as IndexedDB and other browser-based storage APIs) that the SUKI Platform may utilize to store certain Account and loyalty program data locally on Your Device within Your web browser, for purposes of maintaining session continuity, offline functionality, and progressive web application capabilities.

Section 1.08 — "Merchant" shall mean any independent merchant, retailer, food and beverage establishment, service provider, or other business entity that has subscribed to the SUKI Platform to operate a loyalty program for its own customers, as defined in the SUKI Master Subscription and Platform Agreement.

Section 1.09 — "Platform Neutrality" shall mean SUKI's status as a neutral technology intermediary and digital infrastructure provider that does not sell, manufacture, prepare, or provide any goods or services to Users, and does not control, guarantee, endorse, or warrant the goods, services, operations, or business conduct of any Merchant on the SUKI Platform.

Section 1.10 — "PWA" or "Progressive Web Application" shall mean the SUKI Platform's technical architecture, which delivers a mobile application-like user experience through standard web browser technology, without requiring the download or installation of a native mobile application from any application marketplace. The PWA leverages web standards including service workers, web manifests, and web APIs to deliver offline functionality, push notifications (where enabled and consented to), and home screen installability.

Section 1.11 — "Referral Code" shall mean the unique alphanumeric code associated with Your Account that You may share with other individuals to invite them to join the SUKI Platform, subject to the referral rules and limitations set forth in Article 7 of this User Agreement.

Section 1.12 — "Referral Engine" shall mean the feature within the SUKI Platform through which Users may earn additional digital stamps by successfully referring new Users to the SUKI Platform or to a specific Merchant's loyalty program, subject to the strict limitations and anti-fraud provisions of Article 7.

Section 1.13 — "Service Worker" shall mean a type of JavaScript worker file that runs in the background of Your web browser, separate from the main web page, which the SUKI Platform uses to enable background synchronization, offline functionality, and push notification delivery, where Your browser supports such functionality.

Section 1.14 — "Sybil Attack" shall mean any attempt by an individual to create or use multiple, fictitious, fraudulent, or synthetic SUKI Accounts, identities, or credentials, or to collude with others to do so, for the purpose of fraudulently earning additional digital stamps, manipulating the Referral Engine, exploiting promotional campaigns, or otherwise gaming or abusing the SUKI Platform's loyalty and reward systems.

Section 1.15 — "Zero-Party Data" shall have the same meaning ascribed to such term in the SUKI Master Subscription and Platform Agreement (Document 1), as applied to the data voluntarily generated or provided by You through Your use of the SUKI Platform.

ARTICLE 2 — AGE RESTRICTION, CAPACITY, AND ELIGIBILITY

Section 2.01 — Minimum Age Requirement. The SUKI Platform is available only to individuals who are eighteen (18) years of age or older, consistent with the legal age of majority and the age of contractual capacity in the Republic of the Philippines as prescribed under the Civil Code of the Philippines. By registering an Account on the SUKI Platform or by using the SUKI Platform in any manner, You represent, warrant, and affirm, under pain of all applicable legal consequences for false representation, that You are at least eighteen (18) years of age as of the date of Your registration.

Section 2.02 — Minor Users with Parental Consent. Notwithstanding Section 2.01, where a minor below the age of eighteen (18) years (but above the age of thirteen (13) years) desires to use the SUKI Platform, such minor may do so only with the explicit, informed, freely given, and documented consent of a parent or legal guardian who has legal authority over the minor's affairs. In such circumstances, the parent or legal guardian of the minor: (a) shall be the contracting party to this User Agreement on behalf of the minor; (b) shall be fully and personally responsible for the minor's use of the SUKI Platform; (c) shall ensure that the minor's use of the Platform is appropriate and does not contravene any applicable law or these terms; and (d) shall be jointly and severally liable with the minor for any breach of this User Agreement committed by the minor. The use of the SUKI Platform by children under thirteen (13) years of age is absolutely prohibited under all circumstances.

Section 2.03 — Warranty of Capacity. By accepting this User Agreement, You represent and warrant that: (a) You have full legal capacity to enter into a binding contract under Philippine law; (b) You are not under any legal disability or guardianship that would impair Your contractual capacity; (c) Your execution and performance of this User Agreement does not violate any other agreement to which You are a party or any Applicable Law; and (d) all information You provide during the registration process is true, accurate, and complete.

Section 2.04 — One Account Per Person. Each natural person is permitted to maintain only one (1) Account on the SUKI Platform. The creation or use of multiple Accounts by a single individual, whether using different email addresses, phone numbers, devices, or any other means of circumventing SUKI's duplicate detection systems, is strictly prohibited and constitutes a violation of this User Agreement subject to immediate Account termination and forfeiture of all Digital Assets as further described in Article 7.

ARTICLE 3 — SUKI PLATFORM NEUTRALITY AND INTERMEDIARY DISCLAIMERS

Section 3.01 — SUKI as Technology Intermediary Only. THE USER EXPRESSLY ACKNOWLEDGES AND AGREES, WITHOUT QUALIFICATION OR RESERVATION, THAT SUKI IS, IN ALL CIRCUMSTANCES AND AT ALL TIMES, SOLELY AND EXCLUSIVELY A DIGITAL TECHNOLOGY INFRASTRUCTURE PROVIDER, PLATFORM OPERATOR, AND NEUTRAL MULTI-SIDED MARKETPLACE INTERMEDIARY. SUKI DOES NOT, IN ANY MANNER WHATSOEVER, SELL, MANUFACTURE, PREPARE, HANDLE, STORE, TRANSPORT, SUPPLY, OR PROVIDE ANY GOODS, FOOD, BEVERAGES, PRODUCTS, MERCHANDISE, OR SERVICES OF ANY KIND TO USERS. EVERY GOOD, PRODUCT, FOOD ITEM, BEVERAGE, SERVICE, OR OTHER COMMERCIAL OFFERING THAT A USER MAY PURCHASE, CONSUME, OR RECEIVE IN CONNECTION WITH A MERCHANT'S LOYALTY PROGRAM IS EXCLUSIVELY AND SOLELY THE PRODUCT OR SERVICE OF THE INDEPENDENT MERCHANT, AND NOT OF SUKI.

Section 3.02 — No Endorsement of Merchants or Their Offerings. The fact that a Merchant operates a loyalty program on the SUKI Platform does not constitute, and shall not under any circumstances be construed as: (a) SUKI's endorsement, recommendation, certification, accreditation, or approval of the Merchant, the Merchant's business, the Merchant's products or services, the Merchant's business practices, the Merchant's financial stability, or any aspect of the Merchant's operations; (b) any representation or warranty by SUKI regarding the quality, safety, fitness for purpose, compliance with applicable food safety laws, or any other characteristic of the Merchant's goods or services; (c) any representation that the Merchant is a registered, licensed, or otherwise compliant business under Philippine law; or (d) any agreement by SUKI to be responsible for the Merchant's fulfillment of loyalty rewards or any other commercial obligation to Users.

Section 3.03 — Exhaustive Indemnification Against Merchant-Related Claims. SUKI is hereby unconditionally, irrevocably, and completely indemnified against, and shall have absolutely no liability whatsoever to the User or to any third party in connection with, any and all of the following circumstances, claims, or events, which the User, by accepting this User Agreement, expressly and irrevocably agrees shall be exclusively the liability and responsibility of the relevant Merchant:

(a) Reward Failures. Any failure, refusal, delay, inability, or unwillingness of any Merchant to honor, redeem, fulfill, deliver, or otherwise make available any loyalty reward, stamp reward, free item, discount, voucher, promotional offer, or any other benefit promised by the Merchant under its loyalty program, regardless of the reason for such failure, including the Merchant's insolvency, closure, policy change, inventory shortage, or system error;

(b) Personal Injury and Health Claims. Any personal injury (including death), illness, foodborne sickness, allergic reaction, physical harm, psychological harm, or any other harm to the health or well-being of the User or any third person arising from or attributable to: (i) the consumption of any food, beverage, or product offered by any Merchant; (ii) the provision of any service by any Merchant; (iii) conditions at any Merchant's premises; (iv) the actions or omissions of any Merchant's employees, agents, or contractors; or (v) any other aspect of the Merchant's business operations;

(c) Property Damage. Any loss of, or damage to, any property of the User or any third person arising from or attributable to any Merchant's goods, services, premises, or operations;

(d) Merchant Service Failures. Any failure by any Merchant to provide goods or services of the quality, quantity, or description promised or expected by the User, including any short-delivery, mislabeling, misrepresentation of product contents, adulteration, substitution of inferior goods, or non-provision of services;

(e) Merchant Financial Insolvency. Any loss suffered by the User as a result of any Merchant's financial insolvency, bankruptcy, closure, or cessation of business, including the loss of accumulated digital stamps or unredeemed rewards that cannot be redeemed due to the Merchant's closure;

(f) Data Privacy Breaches by Merchants. Any unauthorized access to, loss, theft, or misuse of the User's Personal Information by any Merchant or by any third party as a result of the Merchant's failure to implement adequate data security measures or the Merchant's violation of RA 10173; and

(g) Consumer Law Violations by Merchants. Any violation by any Merchant of the Consumer Act of the Philippines (RA 7394), DTI regulations, food safety regulations, or any other consumer protection law applicable to the Merchant's goods or services.

Section 3.04 — User's Recourse Against Merchants. For any claims, complaints, or grievances arising from a Merchant's goods, services, loyalty program, reward fulfillment, or other commercial conduct, the User's recourse is exclusively against the relevant Merchant directly, and the User may also file a complaint with the appropriate government regulatory authority, including the Department of Trade and Industry (DTI) Consumer Arbitration Office, the Food and Drug Administration (FDA), the local government unit, or any other body with jurisdiction over the Merchant's conduct. SUKI may, at its sole discretion and without any obligation to do so, provide reasonable cooperation to assist the User in identifying the relevant Merchant's contact information.

ARTICLE 4 — PWA TECHNOLOGY, DEVICE SECURITY, AND USER RESPONSIBILITIES

Section 4.01 — Progressive Web Application Technology. The User acknowledges and understands that the SUKI Platform is delivered exclusively as a Progressive Web Application (PWA), which operates entirely through the User's standard web browser and does not require the download or installation of any native mobile application from any application marketplace (including Google Play Store or Apple App Store). The User acknowledges that:

(a) The SUKI Platform's PWA experience is dependent on the capabilities, version, and settings of the User's web browser, and that certain features of the SUKI Platform may not be available or may function differently depending on the User's browser and Device;

(b) The SUKI Platform is designed to work on modern, standards-compliant web browsers including Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge, and that optimal performance requires a recent version of such browsers;

(c) The functionality of the SUKI Platform's PWA features, including home screen installability, push notifications, and offline access, is dependent on the User's browser's support for relevant web standards (including Service Workers, Web App Manifests, and Push API), and that such support varies by browser and operating system;

(d) SUKI makes no warranty that the SUKI Platform will function correctly on all browsers, Devices, or operating systems; and

(e) The User is solely responsible for maintaining their web browser and Device operating system in a current, updated, and secure state.

Section 4.02 — Local Storage and Browser Caching. The User expressly acknowledges, consents to, and accepts the following in connection with the SUKI Platform's use of browser-based storage technologies:

(a) Purpose of Local Storage. The SUKI Platform utilizes browser Local Storage mechanisms (including, as applicable, the Web Storage API's localStorage interface, IndexedDB, and similar browser-native storage mechanisms) to store certain data locally on the User's Device, including without limitation: User Account session tokens; Merchant loyalty program enrollment status; accumulated stamp counts (as a client-side cache, subject to server-side verification); application preferences; offline queue data; and other data necessary for the Platform's PWA functionality. The use of Local Storage is essential to the SUKI Platform's functionality and cannot be disabled without impairing the User's ability to use the Platform.

(b) Browser Cache. The SUKI Platform utilizes the User's web browser's caching mechanisms, including Service Worker-controlled caches, to store static assets (including JavaScript files, CSS stylesheets, images, and other application resources) locally on the User's Device, for the purpose of enabling faster loading times, improved performance, and a degree of offline functionality for the SUKI Platform PWA.

(c) Session Persistence. The SUKI Platform may use session tokens stored in Local Storage to maintain the User's authenticated session across browser sessions, so that the User does not need to log in each time they visit the SUKI Platform. The User acknowledges that if the User accesses the SUKI Platform on a shared Device, other users of such Device may be able to access the User's SUKI Account if the User does not log out prior to relinquishing the Device. SUKI shall have no liability for any unauthorized access to the User's Account resulting from the User's failure to log out of a shared Device.

(d) Data Accuracy. The User acknowledges that data stored in Local Storage is a client-side cache and that the authoritative, binding record of the User's Digital Assets, stamp counts, and Account information is the SUKI server-side database. In the event of any inconsistency between locally cached data and server-side data, the server-side data shall prevail in all circumstances.

Section 4.03 — User's Sole Responsibility for Device and Account Security. The User assumes sole, exclusive, and unconditional responsibility for the security of: (a) the User's Device, including the implementation of a secure screen lock, password protection, biometric authentication, and any other security measures available on the Device; (b) the User's Account Credentials, including the User's chosen password, which must be sufficiently strong and not shared with any other person; (c) all one-time passwords (OTPs) and authentication codes sent to the User's registered mobile number or email address in connection with the User's SUKI Account, which codes must not be disclosed to any other person, including persons purporting to be SUKI employees or representatives; (d) the User's mobile number and email account, through which Account Credentials reset and OTP communications are delivered; and (e) access by other persons to the User's QR code or digital access codes within the SUKI Platform.

Section 4.04 — No Liability for User's Device or Security Failures. SUKI shall have absolutely no liability whatsoever for any loss, theft, unauthorized use, or misappropriation of the User's Digital Assets, Account, or Personal Information arising from: (a) the User's failure to adequately secure their Device; (b) the User's disclosure of Account Credentials or OTPs to any third party; (c) the User's use of the SUKI Platform on a shared or public Device; (d) malware, spyware, or other malicious software on the User's Device; (e) the User's failure to log out of the SUKI Platform on a shared Device; (f) loss, theft, or damage to the User's Device; or (g) any unauthorized access to the User's Account resulting from the User's own actions or omissions.

Section 4.05 — No Liability for Browser or Device Compatibility Issues. SUKI shall have no liability for any failure or degradation of the SUKI Platform's functionality arising from: (a) the User's use of an unsupported, outdated, or non-standard web browser; (b) the User's browser settings (including privacy modes, ad blockers, or cookie restrictions) that interfere with the SUKI Platform's Local Storage or cookie functionality; (c) the User's Device hardware limitations; (d) the User's internet connection speed, reliability, or availability; or (e) any other technical issue arising from the User's Device, browser, or internet connection.

ARTICLE 5 — ANTI-FRAUD PROVISIONS AND ECOSYSTEM INTEGRITY

Section 5.01 — Zero-Tolerance Fraud Policy. The integrity, fairness, and trustworthiness of the SUKI Platform's loyalty ecosystem is foundational to SUKI's ability to provide value to all participating Users and Merchants. SUKI therefore maintains a strict, zero-tolerance policy with respect to all forms of fraud, manipulation, abuse, exploitation, or deception in connection with the SUKI Platform. Any violation of the anti-fraud provisions of this Article 5 shall result in immediate, automatic, and unappealable termination of the User's Account and forfeiture of all Digital Assets, as further described in Section 5.05.

Section 5.02 — Prohibition on Sybil Attacks and Multiple Accounts. The following conduct is absolutely, strictly, and unconditionally prohibited, and constitutes a material breach of this User Agreement:

(a) The creation, registration, activation, or use of more than one (1) SUKI Account by any single natural person, regardless of the methods used to create additional accounts, including but not limited to: the use of different email addresses, mobile phone numbers, Device identifiers, IP addresses, browser fingerprints, or any other identifying information;

(b) The creation, use, or operation of any fictitious, synthetic, robotic, bot-controlled, or otherwise inauthentic Account on the SUKI Platform, or the use of any automated script, bot, macro, or software tool to create or operate a SUKI Account;

(c) Any attempt to create accounts using the names, identity documents, contact details, or other Personal Information of other real or fictitious persons, whether or not such persons consent to such use;

(d) Any collusion or coordination between multiple persons for the purpose of creating networks of accounts, exchanging Account Credentials, or otherwise combining the resources of multiple Accounts to maximize stamp accumulation or reward redemption in a manner inconsistent with bona fide, genuine commercial interactions with Merchants;

(e) Any attempt to systematically exploit the SUKI Platform's onboarding flows, promotional offers, or first-time user benefits by creating fresh accounts after a prior Account has been suspended or terminated; and

(f) Any other attempt to fraudulently inflate the number of apparent SUKI users, Customer accounts, or loyalty program participants through synthetic, artificial, or deceptive means, which category of attack is referred to herein as a "Sybil Attack."

Section 5.03 — Prohibition on QR Code and Access Code Tampering. The following conduct is absolutely, strictly, and unconditionally prohibited:

(a) Any attempt to copy, reproduce, alter, counterfeit, forge, replicate, distribute, or share any QR code or alphanumeric access code provided by SUKI or by any Merchant for use in the SUKI loyalty program, for any purpose other than the User's own legitimate use at the relevant Merchant's physical location;

(b) Any attempt to use any QR code or access code: (i) outside of the Merchant's physical premises; (ii) without a genuine, contemporaneous commercial transaction with the Merchant; (iii) through remote, digital, or other means that do not involve a physical visit to the Merchant's location; or (iv) by means of a screenshot, printed reproduction, or any other copy of a QR code, unless such use is expressly permitted by the Merchant's specific loyalty program terms;

(c) Any attempt to interfere with, manipulate, intercept, reverse-engineer, or tamper with the QR code scanning mechanism, the alphanumeric code validation logic, or any other technical component of the SUKI Platform's stamp issuance or validation system;

(d) Any attempt to exploit technical vulnerabilities, bugs, errors, or unintended behaviors in the SUKI Platform's QR or code logic to obtain Digital Assets to which the User is not legitimately entitled; and

(e) Any sharing, sale, barter, transfer, or distribution of QR codes or access codes to any third party for the purpose of enabling such third party to fraudulently accumulate digital stamps.

Section 5.04 — Referral Engine Fraud Restrictions. With respect to the SUKI Platform's Referral Engine feature:

(a) The maximum referral bonus that any single User may earn through the SUKI Referral Engine is strictly capped at three (3) referral stamps per Merchant loyalty program, per User, regardless of the total number of referrals made. This cap is absolute, non-negotiable, non-waivable, and cannot be increased by any means;

(b) Referral stamps shall only be awarded for genuine, bona fide referrals of new Users who: (i) are natural persons not previously registered on the SUKI Platform; (ii) complete the SUKI registration process using authentic, personal contact information; (iii) independently and genuinely enroll in the relevant Merchant's loyalty program; and (iv) are not accounts created by or for the referring User for the purpose of earning referral stamps;

(c) Any attempt to manipulate the Referral Engine through: the creation of fake referee accounts; the registration of family members, employees, or associates who do not intend to genuinely use the Platform; self-referrals using alternative accounts; or any other fraudulent scheme to artificially generate referral stamps, is strictly prohibited and constitutes a Sybil Attack subject to the consequences described in Section 5.05;

(d) SUKI reserves the right to investigate all referral activities through its fraud detection systems and to retroactively cancel, reverse, or void any referral stamps that SUKI determines, in its sole and absolute discretion, to have been earned through fraudulent or manipulative means; and

(e) The User acknowledges that referral stamps earned through the Referral Engine are subject to all the same limitations, expiration rules, and forfeiture provisions applicable to other Digital Assets under this User Agreement and under the applicable Merchant-Specific Loyalty Terms and Data Waiver.

Section 5.05 — Consequences of Fraud: Immediate and Unappealable Termination and Global Forfeiture.

(a) Upon SUKI's determination, in its sole and absolute discretion, that a User has violated any provision of this Article 5, or any other anti-fraud, anti-manipulation, or acceptable use provision of this User Agreement, SUKI shall have the right to, and shall, immediately, automatically, and without prior notice or warning: (i) terminate the User's Account and all sub-accounts and loyalties linked thereto; (ii) permanently ban the User from the SUKI Platform, including from creating any new Account, whether under the User's own name or any other name or identity; and (iii) effect a global, permanent, and complete forfeiture of all Digital Assets of every kind accumulated in the User's Account and in all Merchant sub-accounts linked to the User's Account, across all Merchant loyalty programs in which the User is or was enrolled, with no compensation, credit, or alternative consideration of any kind.

(b) THE USER EXPRESSLY, IRREVOCABLY, AND UNCONDITIONALLY WAIVES ANY AND ALL RIGHTS TO APPEAL, CHALLENGE, CONTEST, OR SEEK REVIEW OF ANY ACCOUNT TERMINATION OR DIGITAL ASSET FORFEITURE IMPOSED BY SUKI PURSUANT TO THIS SECTION 5.05, WHETHER BEFORE SUKI, ANY MERCHANT, ANY GOVERNMENT AUTHORITY, OR ANY COURT OR ARBITRAL TRIBUNAL. THE USER AGREES THAT SUKI'S DETERMINATION OF A FRAUD VIOLATION UNDER THIS ARTICLE 5 IS FINAL, BINDING, AND CONCLUSIVE.

(c) Without prejudice to the foregoing, SUKI reserves the right, in its sole and absolute discretion, to: (i) report any fraudulent conduct to appropriate law enforcement authorities; (ii) pursue civil legal claims against the User for damages suffered by SUKI, Merchants, or other Users as a result of the User's fraudulent conduct; and (iii) cooperate with law enforcement authorities in any criminal investigation arising from the User's fraudulent activities on the SUKI Platform.

(d) The User acknowledges and agrees that the Digital Assets accumulated on the SUKI Platform have no monetary or cash value and are not redeemable for cash under any circumstances, and that the forfeiture of Digital Assets under this Section 5.05 therefore does not constitute an actionable taking of any monetary value from the User.

ARTICLE 6 — PROHIBITED USES BY END-USERS

Section 6.01 — Prohibited Conduct. In addition to the specific prohibitions set forth in Article 5, the User is strictly, absolutely, and unconditionally prohibited from using the SUKI Platform to:

(a) Engage in any illegal activity under Philippine law;

(b) Harass, threaten, intimidate, defame, or harm any other User, Merchant, or SUKI employee or representative;

(c) Publish or transmit through the SUKI Platform any content that is false, misleading, defamatory, obscene, indecent, pornographic, or otherwise objectionable or unlawful;

(d) Impersonate any person or entity, or misrepresent the User's identity or affiliation;

(e) Interfere with, damage, or disrupt the SUKI Platform or its infrastructure;

(f) Violate the intellectual property rights of SUKI or any third party; or

(g) Use the SUKI Platform for any commercial purpose not authorized by this User Agreement.

ARTICLE 7 — DIGITAL ASSETS, GENERAL LIMITATIONS, AND DISCLAIMERS

Section 7.01 — No Cash Value of Digital Assets on the SUKI Platform Level. Digital Assets accumulated on the SUKI Platform (stamps, referral bonuses, and any other loyalty credits) have absolutely no monetary value, cannot be exchanged for cash, cannot be sold or transferred to any other person or Account, and have no value outside of the specific loyalty program of the specific Merchant in connection with which they were earned, subject always to the terms and conditions of the applicable Merchant-Specific Loyalty Terms and Data Waiver (Document 3).

Section 7.02 — No Ownership of Digital Assets. The User does not own any Digital Assets accumulated on the SUKI Platform. Digital Assets represent only a conditional right to redeem specific rewards offered by the relevant Merchant, subject to the Merchant's loyalty program terms, the Merchant's continued operation, and the User's continued compliance with all applicable terms and conditions. SUKI may, with respect to any Digital Assets at the Platform level, adjust, reset, expire, or forfeit Digital Assets in accordance with this User Agreement.

Section 7.03 — SUKI's Right to Modify Platform. SUKI reserves the right, at any time and in its sole and absolute discretion, to modify, update, suspend, or discontinue any feature or functionality of the SUKI Platform, including any feature related to the accumulation, display, or management of Digital Assets, without prior notice and without liability to the User.

PART TWO: GENERAL PRIVACY POLICY

ARTICLE 8 — SUKI GENERAL PRIVACY POLICY: COLLECTION AND PROCESSING OF USER PERSONAL INFORMATION

This Part Two of this User Agreement constitutes SUKI's General Privacy Policy, setting forth how SUKI, as Personal Information Controller of the User's master profile data (i.e., data collected by SUKI in connection with the User's Account on the SUKI Platform generally, prior to and independently of any Merchant-specific enrollment), collects, uses, stores, protects, and discloses the User's Personal Information. This General Privacy Policy supplements, and does not replace, the specific privacy disclosures made in the Merchant-Specific Loyalty Terms and Data Waiver (Document 3) with respect to data shared with specific Enrolled Merchants.

Section 8.01 — SUKI as Personal Information Controller of Master Profile Data. For purposes of the User's master SUKI Account and profile data, SUKI acts as the Personal Information Controller (PIC) as defined under Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations. SUKI's Data Protection Officer (DPO) may be contacted at the email address designated on the SUKI Platform's privacy and support pages.

Section 8.02 — Categories of Personal Information Collected by SUKI. In connection with the User's registration and use of the SUKI Platform, SUKI collects the following categories of Personal Information from or about the User:

(a) Registration Data: The User's email address; mobile phone number; chosen username or display name; and, where provided, the User's date of birth (for age verification purposes);

(b) Authentication Data: One-time passwords (OTPs) and session tokens used to authenticate the User's identity and maintain the User's authenticated session on the Platform;

(c) Device and Technical Data: Information about the User's Device and browser, including IP address; browser type, version, and language settings; Device operating system and version; Device model and manufacturer; screen resolution; and unique Device identifiers (such as browser fingerprints or hardware identifiers, where technically accessible);

(d) Usage and Interaction Data: Information about how the User uses the SUKI Platform, including pages and features accessed; timestamps of access; navigation patterns; feature engagement data; error logs; and other technical usage metrics;

(e) Loyalty Program Participation Data (Platform Level): Data about the User's overall participation in the SUKI Platform's loyalty ecosystem, including the number and identities of Merchant loyalty programs in which the User is enrolled; the User's platform-level referral activity; and aggregate information about the User's loyalty engagement patterns;

(f) Geolocation Data (Where Consented): The User's precise or approximate geographic location at the time of a loyalty stamp transaction, where the User has granted the SUKI Platform location access permissions through their Device and browser settings. Location data is used to verify the User's physical presence at a Merchant's location during a stamp transaction and to generate location-based analytics; and

(g) Referral Network Data: Information about the User's referral activities, including the identities of Users referred by the User (to the extent that such referred Users have consented to such disclosure) and the referral path through which the User themselves joined the SUKI Platform.

Section 8.03 — Legal Bases for Processing. SUKI processes the User's Personal Information on the following legal bases as prescribed under Section 13 of Republic Act No. 10173:

(a) Performance of a Contract: The processing of the User's Registration Data, Authentication Data, Device and Technical Data, and Loyalty Program Participation Data is necessary for the performance of this User Agreement and for the provision of the SUKI Platform services to the User;

(b) Consent: The processing of the User's Geolocation Data and Referral Network Data is based on the User's freely given, specific, informed, and unambiguous consent, which consent the User may withdraw at any time in the manner described in Section 8.07;

(c) Legitimate Interests: The processing of Usage and Interaction Data for purposes of platform improvement, security, fraud prevention, and analytics is based on SUKI's legitimate interests as a platform operator, provided that such interests are not overridden by the User's fundamental rights and freedoms; and

(d) Compliance with Legal Obligations: SUKI may process the User's Personal Information where necessary to comply with any applicable legal obligation under Philippine law.

Section 8.04 — Purposes of Processing. SUKI uses the User's Personal Information for the following purposes:

(a) To create, manage, authenticate, and maintain the User's Account on the SUKI Platform;

(b) To provide and operate the SUKI Platform's loyalty program features and services;

(c) To verify the User's physical presence at a Merchant's location during a loyalty stamp transaction (using geolocation data, where consented);

(d) To detect, prevent, and investigate fraud, Sybil Attacks, account abuse, and other violations of this User Agreement;

(e) To generate Aggregated Analytics Data for SUKI's own commercial purposes as described in the SUKI Master Subscription and Platform Agreement;

(f) To send the User platform-level communications, including account-related notifications, security alerts, and service announcements;

(g) To improve, develop, and enhance the SUKI Platform's features and functionalities;

(h) To comply with SUKI's legal obligations under Philippine law; and

(i) To share the User's data with Enrolled Merchants to the extent authorized by the User through the Merchant-Specific Loyalty Terms and Data Waiver (Document 3).

Section 8.05 — Disclosure of Personal Information. SUKI discloses the User's Personal Information only in the following circumstances:

(a) To Enrolled Merchants: SUKI shares the User's relevant Personal Information with Enrolled Merchants to the extent and for the purposes authorized by the User through the Merchant-Specific Loyalty Terms and Data Waiver (Document 3). The User expressly acknowledges that upon such sharing, the relevant Enrolled Merchant becomes an independent Personal Information Controller of the shared data.

(b) To SUKI's Service Providers and Sub-Processors: SUKI may disclose the User's Personal Information to third-party service providers that assist SUKI in operating the SUKI Platform, including cloud hosting providers, database management services, analytics providers, email delivery services, and SMS delivery services. Such service providers are contractually bound to process the User's Personal Information only as directed by SUKI and in accordance with appropriate data protection obligations.

(c) For Legal Compliance and Law Enforcement: SUKI may disclose the User's Personal Information to government authorities, law enforcement agencies, or courts where required to do so by Philippine law, by a valid court order, or by a lawful demand from the NPC or other regulatory authority.

(d) For Platform Security and Fraud Prevention: SUKI may disclose the User's Personal Information where necessary to prevent, detect, or investigate fraud, security breaches, or other violations of this User Agreement or applicable law.

(e) Aggregated and De-Identified Data: SUKI may share Aggregated Analytics Data (from which no individual User can be identified) with third parties for commercial, research, or analytical purposes, without restriction.

(f) Corporate Transactions: In the event of a merger, acquisition, sale of assets, joint venture, or other corporate transaction involving SUKI, the User's Personal Information may be transferred to a successor entity, subject to continued compliance with applicable data protection law.

Section 8.06 — Data Retention. SUKI retains the User's Personal Information for the following periods:

(a) Account Data: For as long as the User's Account is active on the SUKI Platform, and for a period of up to two (2) years after the User deactivates or deletes their Account, for purposes of fraud prevention, legal compliance, and dispute resolution;

(b) Transaction and Loyalty Data: For as long as the User's Account is active and for a period of up to three (3) years after the termination or last activity of the relevant Merchant loyalty program enrollment, unless a longer retention period is required by Applicable Law;

(c) Legal Compliance Data: For such periods as may be required by applicable Philippine law; and

(d) Aggregated and De-Identified Analytics Data: Indefinitely, as such data does not constitute Personal Information once properly anonymized and de-identified.

Section 8.07 — Data Subject Rights Under RA 10173. The User, as a data subject under Republic Act No. 10173, has the following rights with respect to their Personal Information processed by SUKI:

(a) Right to Information. The right to be informed of the Personal Information being processed, the purposes of processing, the identity of the Personal Information Controller, and other information required to be disclosed under RA 10173;

(b) Right to Access. The right to request and receive a copy of the Personal Information that SUKI holds about the User, subject to verification of the User's identity and to any limitations permitted by law;

(c) Right to Rectification. The right to request the correction of any inaccurate, outdated, or incomplete Personal Information that SUKI holds about the User;

(d) Right to Erasure ("Right to be Forgotten"). The right to request the deletion or removal of Personal Information that is no longer necessary for the purposes for which it was collected, or where the User has withdrawn consent and there is no other legal basis for processing, subject to SUKI's legitimate interests and legal retention obligations;

(e) Right to Object. The right to object to the processing of Personal Information, including for direct marketing purposes, where processing is based on SUKI's legitimate interests;

(f) Right to Data Portability. The right to receive the User's Personal Information in a structured, commonly used, and machine-readable format, where technically feasible;

(g) Right to Withdraw Consent. The right to withdraw any previously given consent to the processing of Personal Information at any time, without prejudice to the lawfulness of processing based on such consent before its withdrawal; and

(h) Right to Complain. The right to file a complaint with the National Privacy Commission (NPC) if the User believes that SUKI has violated their rights under RA 10173.

To exercise any of the foregoing data subject rights, the User may submit a written request to SUKI's Data Protection Officer at the designated contact address published on the SUKI Platform. SUKI will acknowledge receipt of such request within five (5) Business Days and will endeavor to respond to such requests within thirty (30) calendar days, subject to extension as permitted by RA 10173. SUKI may require the User to provide proof of identity before processing any data subject rights request.

Section 8.08 — Data Security. SUKI implements and maintains appropriate technical and organizational security measures to protect the User's Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Such measures include, without limitation: encryption of data in transit using industry-standard TLS protocols; access controls limiting access to Personal Information to authorized SUKI personnel on a need-to-know basis; regular security assessments and penetration testing of the SUKI Platform; and incident response procedures for handling personal data breaches. Notwithstanding the foregoing, the User acknowledges that no internet-based system is completely secure, and SUKI cannot guarantee the absolute security of the User's Personal Information. In the event of a personal data breach affecting the User's Personal Information, SUKI will notify the User and the NPC as required under Section 20 of RA 10173 and applicable NPC regulations.

Section 8.09 — Cookies and Tracking Technologies. In addition to Local Storage as described in Article 4, the SUKI Platform may use cookies and similar tracking technologies (including session cookies, persistent cookies, and pixel tags) for purposes of authentication, session management, security, and analytics. The User consents to SUKI's use of such technologies by accessing and using the SUKI Platform. The User may manage their cookie preferences through their browser settings, but doing so may impair the functionality of the SUKI Platform.

ARTICLE 9 — DISPUTE RESOLUTION AND GOVERNING LAW

Section 9.01 — Governing Law. This User Agreement shall be governed by, construed in accordance with, and enforced under the laws of the Republic of the Philippines, without regard to conflict of laws principles.

Section 9.02 — Dispute Resolution Process. In the event of any dispute between the User and SUKI arising out of or in connection with this User Agreement, the User's Account, the User's use of the SUKI Platform, or any SUKI privacy practice, the Parties shall first attempt to resolve such dispute through amicable negotiation. The User may submit a formal complaint or dispute to SUKI through the SUKI Platform's support channels, and SUKI shall use commercially reasonable efforts to respond and address the dispute within fifteen (15) Business Days.

Section 9.03 — Arbitration in Metro Manila. If a dispute is not resolved through the User's submission of a complaint under Section 9.02 within forty-five (45) days, the dispute shall be submitted to binding arbitration in Metro Manila, Philippines, in accordance with the applicable arbitration rules of the Philippine Dispute Resolution Center, Inc. (PDRCI), or such other arbitration institution as may be mutually agreed in writing. The arbitration shall be conducted in the English language, by a sole arbitrator mutually agreed upon by the Parties or appointed in accordance with the applicable rules. The arbitration award shall be final and binding. Each Party shall bear its own legal costs, with arbitration fees shared equally unless the award provides otherwise.

Section 9.04 — Injunctive Relief. Notwithstanding the arbitration obligation in Section 9.03, SUKI may seek emergency injunctive or other equitable relief from a competent court in Metro Manila, without prior notice and without being required to post bond, where necessary to prevent irreparable harm to the SUKI Platform, to SUKI's Intellectual Property Rights, or to the rights or Personal Information of other Users, including in cases of actual or threatened Sybil Attacks or other fraudulent conduct.

ARTICLE 10 — GENERAL PROVISIONS

Section 10.01 — Amendments to User Agreement. SUKI reserves the right to amend, modify, or update this User Agreement at any time. SUKI will notify the User of material changes to this User Agreement by posting the updated agreement on the SUKI Platform or by sending a notification to the User's registered email address or mobile number. The User's continued use of the SUKI Platform after the effective date of any amendment shall constitute the User's unconditional acceptance of the amended User Agreement.

Section 10.02 — Account Termination by User. The User may terminate their Account at any time by following the account deletion process within the SUKI Platform's settings. Upon account deletion: (a) all Digital Assets accumulated in the User's Account and all Merchant sub-accounts will be immediately and permanently forfeited with no compensation; (b) the User's enrollment in all Merchant loyalty programs will be terminated; and (c) SUKI will process the deletion of the User's Personal Information in accordance with Section 8.06 and the post-termination data retention obligations of this User Agreement.

Section 10.03 — Account Termination by SUKI. SUKI reserves the right to suspend or terminate any User's Account at any time, with or without notice, for any violation of this User Agreement or for any other reason that SUKI, in its sole and absolute discretion, determines to be appropriate, including conduct that is harmful to the SUKI Platform, to other Users, or to Merchants.

Section 10.04 — Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE PHILIPPINE LAW, SUKI'S TOTAL AGGREGATE LIABILITY TO THE USER FOR ALL CLAIMS ARISING UNDER OR IN CONNECTION WITH THIS USER AGREEMENT SHALL NOT EXCEED ONE THOUSAND PHILIPPINE PESOS (PHP 1,000.00). SUKI SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES OF ANY NATURE, INCLUDING LOSS OF DATA, LOSS OF DIGITAL ASSETS, OR LOSS OF PROFITS.

Section 10.05 — Severability. If any provision of this User Agreement is held invalid, illegal, or unenforceable, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and all other provisions shall remain in full force and effect.

Section 10.06 — Entire Agreement. This User Agreement, together with the Merchant-Specific Loyalty Terms and Data Waiver (Document 3) executed upon enrollment in any Merchant's loyalty program, constitutes the entire agreement between the User and SUKI with respect to the User's use of the SUKI Platform, and supersedes all prior agreements, representations, and understandings.

End of Document 2 — SUKI End-User Platform Agreement and General Privacy Policy

By completing the SUKI Platform customer registration process and indicating acceptance of these terms, the User acknowledges that they have read, understood, and unconditionally agreed to be legally bound by all terms and conditions of this User Agreement.