SUKI PLATFORM — MASTER SUBSCRIPTION AND PLATFORM AGREEMENT

(For Merchant Onboarding — Document 1 of 3)

EFFECTIVE DATE: The date on which the Merchant completes the digital registration process and affirmatively clicks the "I Agree" or equivalent acceptance button on the SUKI Platform onboarding interface, which act shall constitute the Merchant's full, unconditional, and legally binding acceptance of every term, condition, covenant, representation, warranty, obligation, limitation, and provision set forth herein and in all schedules, annexes, addenda, and incorporated documents referenced herein (the "Effective Date").

PARTIES

This Master Subscription and Platform Agreement (hereinafter referred to as the "Agreement," the "Master Agreement," or the "MSPA") is entered into by and between:

SUKI PLATFORM OPERATIONS (hereinafter referred to as "SUKI," the "Platform Operator," the "Company," or the "Service Provider"), a business entity duly organized, existing, and operating under the laws of the Republic of the Philippines, with its principal place of business at an address on file with the Securities and Exchange Commission of the Philippines, acting through its authorized officers and representatives;

— AND —

THE MERCHANT (hereinafter referred to as the "Merchant," the "Subscribing Party," the "Subscriber," or the "Business Entity"), being the individual proprietor, partnership, corporation, cooperative, association, or other juridical or natural person that has completed the SUKI merchant registration process, whose business name, trade name, registered address, tax identification number, business permit number, and contact details have been submitted through the SUKI Merchant Dashboard registration interface and are hereby incorporated into this Agreement by reference as if fully set forth herein.

SUKI and the Merchant are hereinafter sometimes referred to individually as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, SUKI has developed, owns, operates, and continuously maintains a proprietary multi-merchant digital loyalty platform delivered as a Progressive Web Application (hereinafter "PWA") under the trade name "SUKI," which platform enables merchants to create, manage, configure, and operate digital customer loyalty programs through which customers of participating merchants may accumulate digital stamps, redeem rewards, and engage with merchant-specific loyalty campaigns, all within a unified, mobile-accessible, app-free web technology framework;

WHEREAS, SUKI's platform is designed to function across a variety of devices and operating systems through standard web browser technology, without requiring the installation of a dedicated native mobile application, and leverages browser-based local storage, service worker technology, progressive enhancement methodologies, and web-standard application programming interfaces to deliver a seamless, persistent user experience;

WHEREAS, SUKI operates as a neutral, multi-sided technology marketplace and infrastructure provider, offering the SUKI Platform as a software-as-a-service (SaaS) solution to Merchants on a subscription basis, and does not itself operate as a merchant, retailer, food service provider, service provider, or seller of goods or services to end-user consumers;

WHEREAS, the Merchant is a legitimate business entity operating within the Republic of the Philippines, duly licensed to conduct its trade or business under applicable Philippine law, and desires to subscribe to the SUKI Platform to implement a digital loyalty program for its own customers in connection with the Merchant's own independent commercial operations;

WHEREAS, in the course of operating a loyalty program through the SUKI Platform, both SUKI and the Merchant will inevitably come into contact with Personal Information (as defined under Republic Act No. 10173, otherwise known as the "Data Privacy Act of 2012," and its Implementing Rules and Regulations) of the Merchant's customers and end-users of the SUKI Platform, necessitating a clear, unambiguous, legally compliant allocation of data protection roles, responsibilities, and liabilities between the Parties in accordance with Philippine data privacy law;

WHEREAS, the Parties desire to set forth in this Agreement the complete, exclusive, and controlling terms and conditions governing the relationship between SUKI and the Merchant with respect to: (i) the Merchant's subscription to and use of the SUKI Platform; (ii) the licensing of SUKI's intellectual property to the Merchant on a limited basis; (iii) the respective roles, rights, and obligations of the Parties as Personal Information Controller and Personal Information Processor under RA 10173; (iv) the allocation of liability and indemnification obligations between the Parties; (v) the fees, payment terms, and subscription obligations of the Merchant; and (vi) the termination of the subscription relationship and the handling of data upon termination;

NOW, THEREFORE, in consideration of the mutual covenants, promises, representations, warranties, and agreements contained herein, the adequacy and sufficiency of which consideration are hereby acknowledged by both Parties, and intending to be legally bound hereby, the Parties agree as follows:

ARTICLE I — DEFINITIONS

For all purposes of this Agreement, the following terms, when used with initial capitalization, shall have the meanings ascribed to them in this Article I, unless the context expressly requires otherwise. Where a defined term is used in the singular, it shall include the plural, and vice versa. Where a defined term is used in one grammatical form, it shall include all other grammatical forms as the context requires.

Section 1.01 — "Acceptable Use Policy" or "AUP" shall mean the policies, rules, guidelines, and restrictions governing the Merchant's use of the SUKI Platform, as set forth in Article VIII of this Agreement and as may be updated, supplemented, or amended by SUKI from time to time in its sole and absolute discretion, with or without prior notice, provided that SUKI shall use commercially reasonable efforts to notify the Merchant of material changes to the AUP.

Section 1.02 — "Aggregated Analytics Data" shall mean all data, metrics, statistics, reports, insights, analyses, trends, patterns, benchmarks, and derived information generated by SUKI through the processing, compilation, normalization, aggregation, anonymization, pseudonymization, de-identification, and statistical analysis of Platform Usage Data, Merchant Data, Customer Transaction Data, and all other data inputs across all merchants on the SUKI Platform, in such form and presentation that no individual natural person is or can reasonably be identified, re-identified, singled out, or distinguished from such aggregated, de-identified dataset, and which dataset no longer constitutes "Personal Information" or "Sensitive Personal Information" as defined under RA 10173.

Section 1.03 — "Agreement" shall mean this Master Subscription and Platform Agreement, together with all schedules, exhibits, annexes, addenda, order forms, and all documents expressly incorporated herein by reference, as the same may be amended, restated, supplemented, or modified from time to time in accordance with the terms hereof.

Section 1.04 — "Applicable Law" shall mean all laws, statutes, ordinances, regulations, rules, codes, orders, decrees, guidelines, directives, circulars, and other legally binding requirements of any governmental authority, regulatory body, or administrative agency having jurisdiction over the Parties or the subject matter of this Agreement, including without limitation: Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations; Republic Act No. 8792 (Electronic Commerce Act of 2000); Republic Act No. 7394 (Consumer Act of the Philippines); Republic Act No. 8293 (Intellectual Property Code of the Philippines); Act No. 3883 (Trade Name Law); the rules and regulations of the National Privacy Commission (NPC); the rules and regulations of the Department of Trade and Industry (DTI); the rules and regulations of the Bureau of Internal Revenue (BIR); and all applicable local government ordinances and regulations.

Section 1.05 — "Authorized Users" shall mean the individual employees, officers, agents, contractors, and representatives of the Merchant who have been authorized by the Merchant to access and use the SUKI Merchant Dashboard on the Merchant's behalf, subject always to the access controls, user limits, and permission structures established by SUKI and as configured by the Merchant within the Platform.

Section 1.06 — "Business Day" shall mean any day other than a Saturday, Sunday, or a day declared as a regular or special non-working holiday under Philippine law applicable to the National Capital Region (Metro Manila), Philippines.

Section 1.07 — "Confidential Information" shall mean all non-public, proprietary, or confidential information disclosed by one Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement, whether disclosed orally, in writing, electronically, visually, or by any other means, and whether or not marked or designated as "confidential" or "proprietary," including without limitation: trade secrets; source code; algorithms; platform architecture; API specifications; database schemas; pricing information; customer lists; business plans; financial data; marketing strategies; product roadmaps; and the specific terms and conditions of this Agreement; provided, however, that Confidential Information shall not include information that: (i) is or becomes publicly available through no fault or breach of the Receiving Party; (ii) was rightfully known to the Receiving Party prior to disclosure without restriction; (iii) is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; or (iv) is required to be disclosed by Applicable Law or by order of a court or governmental authority of competent jurisdiction, provided that the Receiving Party gives the Disclosing Party prompt prior written notice of such requirement to the extent permitted by law.

Section 1.08 — "Customer" or "End-User"** shall mean any natural person who has registered a user account on the SUKI Platform, whether or not such person has enrolled in any specific Merchant loyalty program, and whose Personal Information is collected, processed, and stored on the SUKI Platform in connection with their participation in the SUKI loyalty ecosystem.

Section 1.09 — "Customer Transaction Data" shall mean all data generated by, arising from, or relating to a Customer's interactions with the SUKI Platform in connection with the Merchant's loyalty program, including without limitation: the date, time, and timestamp of each digital stamp issuance event; the precise geolocation coordinates of the transaction (where enabled and consented to); the unique identifier of the QR code or alphanumeric code used in the transaction; the cumulative stamp count; the redemption events; the referral events; and all associated metadata.

Section 1.10 — "Data Processing Agreement" or "DPA Annex" shall mean the data processing terms and conditions set forth in Article IV of this Agreement, together with Schedule A attached hereto, which Schedule A is incorporated herein by reference and forms an integral and inseverable part of this Agreement, governing the respective roles, obligations, rights, and liabilities of SUKI as Personal Information Processor and the Merchant as Personal Information Controller under RA 10173.

Section 1.11 — "Documentation" shall mean all user guides, technical manuals, help articles, API documentation, onboarding materials, tutorial videos, and other support materials made available by SUKI to the Merchant through the SUKI Merchant Dashboard, the SUKI support portal, or such other channels as SUKI may designate from time to time.

Section 1.12 — "Effective Date" shall have the meaning ascribed to it in the preamble of this Agreement.

Section 1.13 — "Force Majeure Event" shall mean any event, occurrence, or circumstance beyond the reasonable control of the affected Party that prevents or materially impairs such Party's ability to perform its obligations under this Agreement, including without limitation: acts of God; natural disasters (including typhoons, floods, earthquakes, volcanic eruptions, and landslides); war; invasion; terrorism; civil unrest or civil war; actions of governmental authorities (including quarantine orders, lockdowns, emergency declarations, and regulatory shutdowns); pandemics or epidemics recognized by the World Health Organization or the Department of Health of the Philippines; strikes or labor disputes not involving the affected Party's own employees; power outages; telecommunications failures; internet backbone failures; failures of third-party hosting providers or cloud infrastructure providers; and cyber-attacks, distributed denial-of-service attacks, or other malicious digital interference originating from outside the Platform.

Section 1.14 — "Intellectual Property Rights" shall mean all patents, utility models, copyrights, trademarks, service marks, trade names, trade dress, trade secrets, database rights, moral rights, rights in inventions, rights in designs, domain names, internet account names and addresses, goodwill, know-how, and all other intellectual property rights and proprietary rights, whether registered or unregistered, and all applications and rights to apply for registration of any of the foregoing, in each case subsisting anywhere in the world.

Section 1.15 — "Merchant Dashboard" shall mean the web-based administrative interface provided by SUKI to the Merchant as part of the SUKI Platform, through which the Merchant may configure its loyalty program parameters, view customer analytics and engagement data, manage stamp issuance codes and QR codes, communicate with enrolled customers (subject to applicable consent and communications laws), and perform other administrative functions as may be made available by SUKI from time to time.

Section 1.16 — "Merchant Data" shall mean all data, content, information, and materials uploaded, submitted, provided, or made available to SUKI by or on behalf of the Merchant in the course of using the SUKI Platform, including without limitation: the Merchant's business name, logo, brand assets, reward descriptions, promotional copy, images, and other merchant-specific content displayed to Customers; the Merchant's business and contact information; and all configurations and settings applied by the Merchant to its loyalty program within the Platform.

Section 1.17 — "National Privacy Commission" or "NPC" shall mean the independent government body established under Republic Act No. 10173 and its Implementing Rules and Regulations, with the authority to administer and implement the provisions of the Data Privacy Act of 2012 and to adjudicate complaints involving violations thereof.

Section 1.18 — "Personal Information" or "PI" shall have the meaning ascribed to such term under Section 3(g) of Republic Act No. 10173 and its Implementing Rules and Regulations, meaning any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

Section 1.19 — "Personal Information Controller" or "PIC" shall have the meaning ascribed to such term under Section 3(h) of Republic Act No. 10173 and its Implementing Rules and Regulations, meaning a natural or juridical person, or any other body who controls the processing of personal data, or instructs another to process personal data on their behalf.

Section 1.20 — "Personal Information Processor" or "PIP" shall have the meaning ascribed to such term under Section 3(i) of Republic Act No. 10173 and its Implementing Rules and Regulations, meaning any natural or juridical person or any other body to whom a personal information controller may outsource or instruct the processing of personal data pertaining to a data subject.

Section 1.21 — "Platform" or "SUKI Platform" shall mean the SUKI multi-merchant digital loyalty Progressive Web Application, including all associated software, algorithms, databases, APIs, infrastructure, interfaces (including the Customer-facing PWA and the Merchant Dashboard), features, functionalities, analytics engines, QR code generation and validation systems, referral tracking systems, notification services, and all related technology, systems, and services owned, operated, or licensed by SUKI, as updated, enhanced, modified, or replaced by SUKI from time to time in its sole discretion.

Section 1.22 — "Platform Usage Data" shall mean all data generated by or arising from the use of the SUKI Platform by Customers and Merchants, including server logs, access logs, performance metrics, error reports, system telemetry, feature usage statistics, session data, and device and browser information, excluding Personal Information that has not been anonymized or de-identified.

Section 1.23 — "Republic Act No. 10173" or "RA 10173" or "Data Privacy Act" shall mean Republic Act No. 10173, otherwise known as the "Data Privacy Act of 2012," as amended, and its Implementing Rules and Regulations, all NPC circulars, advisories, guidelines, and issuances implementing or interpreting the same, as the same may be amended or superseded from time to time.

Section 1.24 — "Sensitive Personal Information" or "SPI" shall have the meaning ascribed to such term under Section 3(l) of Republic Act No. 10173 and its Implementing Rules and Regulations.

Section 1.25 — "Service Level" shall mean the standards of availability, performance, and uptime applicable to the SUKI Platform as further described in Article VI of this Agreement.

Section 1.26 — "Subscription Fee" shall mean the periodic fee payable by the Merchant to SUKI in consideration of the Merchant's access to and use of the SUKI Platform, as set forth in the applicable subscription plan selected by the Merchant during the registration process or as subsequently modified in accordance with Article VII of this Agreement.

Section 1.27 — "Subscription Term" shall mean the period during which the Merchant is subscribed to the SUKI Platform, commencing on the Effective Date and continuing until terminated in accordance with Article XI of this Agreement.

Section 1.28 — "Term" shall have the same meaning as "Subscription Term" as defined in Section 1.27.

Section 1.29 — "Zero-Party Data" shall mean Personal Information voluntarily and proactively provided or generated by Customers through their active and intentional interaction with the SUKI Platform and the Merchant's loyalty program, as distinguished from first-party data (passively observed behavioral data) or second-party data (data shared between partners), including without limitation: the Customer's explicitly stated email address; visit frequency patterns; timestamps of loyalty interactions; geolocation data of loyalty events where consented to; referral network connections; and loyalty engagement preferences.

ARTICLE II — GRANT OF PLATFORM LICENSE

Section 2.01 — Grant of Limited License. Subject to the Merchant's full and continuous compliance with all terms and conditions of this Agreement, including without limitation the timely payment of all applicable Subscription Fees, SUKI hereby grants to the Merchant, for the duration of the Subscription Term only, a limited, non-exclusive, non-transferable, non-sublicensable, revocable, and personal license to: (a) access and use the SUKI Merchant Dashboard through standard web browser technology solely for the purpose of configuring, managing, and operating the Merchant's own digital loyalty program for the Merchant's own bona fide customers; (b) display the SUKI Platform's customer-facing interface to the Merchant's customers at the Merchant's business premises through the use of SUKI-provided QR codes and alphanumeric access codes; and (c) access and use the Documentation solely in connection with the Merchant's authorized use of the SUKI Platform.

Section 2.02 — Scope Limitations. The license granted in Section 2.01 is strictly limited to the Merchant's own internal business operations in connection with its lawfully operated loyalty program. The Merchant is expressly prohibited from: (a) sublicensing, transferring, assigning, pledging, encumbering, or otherwise disposing of the license or any rights thereunder to any third party; (b) allowing any third party other than the Merchant's own Authorized Users to access or use the SUKI Merchant Dashboard; (c) using the SUKI Platform to operate a loyalty program on behalf of any other merchant, business, or entity not party to this Agreement; (d) using the SUKI Platform for any purpose other than the operation of the Merchant's own legitimate commercial loyalty program; or (e) using the SUKI Platform in any manner that contravenes or is inconsistent with the Acceptable Use Policy or any provision of this Agreement.

Section 2.03 — Reservation of Rights. All rights in and to the SUKI Platform and all Intellectual Property Rights therein not expressly granted to the Merchant under Section 2.01 are, and shall at all times remain, exclusively reserved to SUKI. The Merchant acknowledges and agrees that this Agreement does not grant the Merchant any ownership interest, equity interest, proprietary right, or beneficial right of any nature in or to the SUKI Platform, and nothing in this Agreement shall be construed as a sale, transfer, or assignment of any Intellectual Property Rights of SUKI to the Merchant. SUKI reserves the unconditional right to modify, enhance, update, replace, suspend, or discontinue any feature, functionality, or component of the SUKI Platform at any time, in its sole and absolute discretion, with or without notice.

Section 2.04 — Authorized Users. The Merchant shall be solely and exclusively responsible for: (a) identifying, designating, and managing its Authorized Users; (b) ensuring that all Authorized Users comply with all applicable terms and conditions of this Agreement as if such Authorized Users were parties hereto; (c) maintaining the confidentiality and security of all user credentials, login details, passwords, and access tokens issued in connection with the Merchant's SUKI account; and (d) immediately notifying SUKI in writing of any actual or suspected unauthorized access to, or unauthorized use of, the Merchant's SUKI account. The Merchant acknowledges and agrees that all actions taken by its Authorized Users through the Merchant's SUKI account shall be deemed to be the actions of the Merchant itself for all purposes of this Agreement, and the Merchant shall be fully and unconditionally liable for all such actions.

ARTICLE III — INTELLECTUAL PROPERTY RIGHTS AND PLATFORM OWNERSHIP

Section 3.01 — Ownership of Platform and IP. The Merchant acknowledges and agrees, without qualification or reservation, that SUKI is and shall remain the sole and exclusive owner of all right, title, and interest in and to: (a) the SUKI Platform in its entirety, including all software code (whether in source code, object code, or compiled form), algorithms, data structures, database schemas, APIs, user interface designs, UX/UI elements, visual assets, icons, color schemes, and all other components thereof; (b) all modifications, improvements, enhancements, updates, new versions, and derivative works of the SUKI Platform, whether developed by SUKI alone or in collaboration with others; (c) the SUKI trade name, trademark, service mark, logo, and all associated brand elements and goodwill; (d) all Aggregated Analytics Data generated by SUKI through its operation of the Platform; (e) all Platform Usage Data; and (f) all trade secrets, know-how, methodologies, and proprietary processes developed by SUKI in connection with the Platform.

Section 3.02 — Prohibition on Reverse Engineering. The Merchant is absolutely and unconditionally prohibited from, directly or indirectly, either itself or through any third party: (a) reverse engineering, decompiling, disassembling, decoding, decrypting, or otherwise attempting to derive the source code, structure, algorithms, or underlying ideas of the SUKI Platform or any component thereof; (b) scraping, data mining, or using automated tools to systematically extract data from the SUKI Platform, the Merchant Dashboard, or any API provided by SUKI, except as expressly authorized by SUKI in writing; (c) circumventing, disabling, or otherwise interfering with any security feature, access control, authentication mechanism, or encryption system of the SUKI Platform; (d) creating any derivative work based on or incorporating any component of the SUKI Platform without SUKI's prior written consent; (e) using any robot, spider, crawler, or other automated device to access, monitor, or copy the SUKI Platform; or (f) accessing the SUKI Platform for the purpose of building a competing product or service.

Section 3.03 — Merchant Data Ownership. As between the Parties, the Merchant retains ownership of: (a) the Merchant's own business name, logo, trademarks, and brand assets submitted to the SUKI Platform as Merchant Data; and (b) the specific customer list of Customers who have enrolled in the Merchant's specific loyalty program on the SUKI Platform and whose Personal Information has been shared with the Merchant pursuant to Document 3 (Merchant-Specific Loyalty Terms & Data Waiver). The Merchant's ownership of its customer list is subject to: (i) the data protection obligations imposed on the Merchant as a Personal Information Controller under RA 10173; (ii) the export and deletion protocols applicable upon termination of this Agreement as described in Article XI; and (iii) SUKI's permanent, irrevocable right to retain and use Aggregated Analytics Data derived from the processing of the Merchant's customer data on an anonymized, de-identified basis, as further described in Section 3.04.

Section 3.04 — SUKI's Irrevocable Aggregated Analytics Rights. Notwithstanding any other provision of this Agreement, and notwithstanding the termination or expiration of this Agreement for any reason whatsoever, the Merchant hereby irrevocably, unconditionally, and perpetually grants to SUKI, and SUKI hereby retains as a pre-existing and continuing right, the permanent, perpetual, worldwide, royalty-free, irrevocable, and fully sub-licensable right to: (a) process, analyze, compile, aggregate, anonymize, de-identify, and pseudonymize any and all Customer Transaction Data, Platform Usage Data, Zero-Party Data, and other data generated through the Merchant's loyalty program on the SUKI Platform for the purpose of generating Aggregated Analytics Data; (b) retain, store, use, publish, license, transfer, and exploit such Aggregated Analytics Data for any and all lawful commercial purposes, including without limitation: product development; market research and analysis; benchmarking; industry reporting; investor presentations; platform improvement; and commercial analytics services offered to third parties; and (c) disclose Aggregated Analytics Data to any third party without restriction, provided that such Aggregated Analytics Data does not identify or reasonably allow the identification of any individual Customer or the Merchant. The Merchant expressly acknowledges and agrees that SUKI's rights under this Section 3.04 shall survive the termination or expiration of this Agreement indefinitely and shall not be subject to revocation, restriction, or limitation by the Merchant at any time and for any reason.

Section 3.05 — Feedback. To the extent that the Merchant or any of its Authorized Users provides SUKI with any suggestions, feedback, ideas, recommendations, or other input regarding the SUKI Platform (collectively, "Feedback"), the Merchant hereby assigns and transfers to SUKI, without compensation or restriction, all right, title, and interest in and to such Feedback, including all Intellectual Property Rights therein, and SUKI shall have the unrestricted right to use, implement, commercialize, and exploit such Feedback for any purpose without obligation or liability to the Merchant.

ARTICLE IV — DATA PROTECTION AND PROCESSING TERMS (DATA PROCESSING AGREEMENT)

Section 4.01 — Designation of Roles Under RA 10173.

(a) SUKI as Personal Information Processor. The Parties expressly acknowledge, confirm, and agree that, for all purposes of Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations, SUKI acts solely and exclusively in the capacity of a Personal Information Processor (PIP) with respect to the Personal Information of the Merchant's Customers that is collected, stored, and processed through the SUKI Platform in connection with the Merchant's loyalty program. In its capacity as PIP, SUKI processes Customer Personal Information only upon and pursuant to the documented instructions of the Merchant, as set forth in this Agreement and as further detailed through the configuration of the loyalty program in the Merchant Dashboard. SUKI does not, for the Merchant's customer data specifically, determine the purposes or means of processing such data independently; rather, SUKI acts as a processor of such data on behalf of and under the direction of the Merchant. Provided, however, that SUKI's designation as PIP applies exclusively to Customer Personal Information processed within the Merchant's loyalty program context, and does not apply to: (i) Aggregated Analytics Data, which SUKI processes as an autonomous PIC for its own legitimate business purposes; (ii) Platform Usage Data and Platform telemetry data; or (iii) data processed by SUKI for its own regulatory compliance, fraud prevention, platform security, and business operations purposes.

(b) The Merchant as Personal Information Controller. The Parties expressly acknowledge, confirm, and agree that, for all purposes of RA 10173, the Merchant acts in the capacity of a Personal Information Controller (PIC) with respect to the Personal Information of its Customers processed through the SUKI Platform in connection with the Merchant's loyalty program. As PIC, the Merchant: (i) determines the purposes for which the Customer's Personal Information is collected and processed through the Merchant's loyalty program; (ii) is responsible for ensuring that a valid legal basis for processing (as enumerated under Section 13 of RA 10173) exists for each processing activity undertaken through the SUKI Platform; (iii) is responsible for ensuring that all required notices and disclosures under the Data Privacy Act are made to Customers prior to or at the time of collection of their Personal Information; (iv) is solely and exclusively responsible for ensuring that the Merchant's use of the Customer data, including for direct marketing communications as contemplated under Document 3, is conducted strictly in compliance with RA 10173 and all applicable NPC issuances and regulations; and (v) bears primary liability to data subjects and to the NPC for any violation of the Data Privacy Act arising from the Merchant's collection, use, disclosure, or other processing of Customer Personal Information.

Section 4.02 — Merchant's Obligations as Personal Information Controller. Without limiting the generality of Section 4.01(b), the Merchant, as the Personal Information Controller of its Customers' data, hereby represents, warrants, and undertakes the following:

(a) The Merchant has, prior to enrolling Customers in its loyalty program through the SUKI Platform, ensured that each Customer has been provided with a clear, comprehensive, and compliant privacy notice (as required under Sections 16 and 17 of RA 10173) informing the Customer of: (i) the identity and contact details of the Merchant as the PIC; (ii) the purposes of the collection and processing of the Customer's Personal Information; (iii) the types of Personal Information collected; (iv) the recipients or categories of recipients to whom the Customer's Personal Information will be disclosed; (v) the Customer's rights as a data subject under RA 10173; and (vi) the retention periods applicable to the Customer's Personal Information.

(b) The Merchant has obtained, or shall obtain prior to the relevant processing activity, all necessary, valid, freely given, specific, informed, and unambiguous consents from Customers as may be required by RA 10173 and applicable NPC regulations, including in particular the consent required for the direct marketing uses contemplated by Document 3.

(c) The Merchant shall implement and maintain adequate and appropriate organizational, physical, and technical security measures to protect the Customer Personal Information received from SUKI against unauthorized access, acquisition, disclosure, loss, alteration, or destruction, at a level no less stringent than the security standards prescribed by the NPC under its circulars and advisories, and in any event at a level commensurate with the nature, sensitivity, and volume of the Personal Information concerned.

(d) The Merchant shall designate a Data Protection Officer (DPO) if required to do so under applicable NPC regulations, register such DPO with the NPC, and ensure that the DPO performs all functions required under RA 10173 and its Implementing Rules and Regulations.

(e) The Merchant shall not instruct SUKI to process Customer Personal Information in any manner that would cause SUKI to violate any provision of RA 10173 or any applicable NPC regulation.

(f) The Merchant shall promptly notify SUKI in writing of any data subject request received from a Customer exercising their data subject rights under RA 10173 (including the right to access, right to rectification, right to erasure, right to object, and right to data portability) to the extent that fulfillment of such request requires action on SUKI's part as PIP, and SUKI shall use commercially reasonable efforts to assist the Merchant in responding to such requests within the timeframes prescribed by RA 10173.

Section 4.03 — SUKI's Obligations as Personal Information Processor. In its capacity as Personal Information Processor, SUKI undertakes to:

(a) Process Customer Personal Information only on the basis of the documented instructions of the Merchant as PIC, as set forth in this Agreement, and not for any other purpose except as required by Philippine law, court order, or NPC directive, in which case SUKI shall, to the extent permitted by law, inform the Merchant before such processing;

(b) Implement and maintain appropriate technical and organizational security measures to protect Customer Personal Information processed on behalf of the Merchant against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, in accordance with the security obligations prescribed under RA 10173 and applicable NPC regulations;

(c) Ensure that SUKI personnel who have access to Customer Personal Information are subject to enforceable confidentiality obligations and are provided with appropriate data privacy training;

(d) Notify the Merchant promptly, and in any case within twenty-four (24) hours of becoming aware thereof, of any actual or suspected personal data breach affecting Customer Personal Information processed on behalf of the Merchant, and cooperate with the Merchant in complying with the Merchant's breach notification obligations under Section 20 of RA 10173 and the NPC's breach notification protocols;

(e) Upon termination of this Agreement, and at the Merchant's written election, either: (i) return to the Merchant all Customer Personal Information processed on behalf of the Merchant, in a structured, commonly used, and machine-readable format as further described in Article XI; or (ii) securely delete and destroy all copies of Customer Personal Information in SUKI's systems within sixty (60) days of termination, and provide the Merchant with written confirmation of such deletion; provided, however, that SUKI shall be entitled to retain Aggregated Analytics Data in perpetuity as described in Section 3.04; and

(f) Make available to the Merchant all information necessary to demonstrate SUKI's compliance with the obligations of a Personal Information Processor under RA 10173, and allow for and contribute to audits and inspections conducted by the Merchant or a qualified auditor mandated by the Merchant, subject to the audit rights provisions of Section 4.04.

Section 4.04 — Merchant's Audit Rights. The Merchant shall have the right, no more than once per calendar year, upon not less than thirty (30) Business Days' prior written notice to SUKI, and at the Merchant's sole cost and expense, to conduct or commission an independent audit of SUKI's data processing practices as they relate to the Merchant's Customer Personal Information, for the purpose of verifying SUKI's compliance with its obligations as Personal Information Processor under this Agreement and under RA 10173; provided, however, that: (a) any such audit shall be conducted during normal business hours and in a manner that does not unreasonably disrupt SUKI's operations; (b) the Merchant and any third-party auditor engaged by the Merchant shall, prior to commencing any audit, execute a non-disclosure agreement with SUKI in a form acceptable to SUKI, protecting SUKI's Confidential Information and the Personal Information of other merchants and their customers on the SUKI Platform; (c) no audit may access, review, or examine data of other Merchants or their customers; and (d) in lieu of an on-site audit, SUKI may, at its election, provide the Merchant with copies of any relevant independent third-party security or privacy audits or certifications (including ISO 27001, SOC 2 Type II, or equivalent certifications) that adequately address the subject matter of the proposed audit, which provision shall be deemed to satisfy the Merchant's audit rights for the relevant period. SUKI shall promptly remediate any material non-compliance identified in any audit in a manner and within a timeframe reasonably agreed by the Parties.

Section 4.05 — Data Sharing Agreement. This Article IV, together with Schedule A, constitutes the Data Sharing Agreement required under Section 20(c) of RA 10173 and applicable NPC circulars governing data sharing between a Personal Information Controller (the Merchant) and a Personal Information Processor (SUKI) in connection with the loyalty program operations described herein. The Merchant represents and warrants that it has independently assessed the necessity and proportionality of the data sharing arrangements established under this Agreement and that such arrangements comply with all requirements of RA 10173 and applicable NPC regulations.

ARTICLE V — LIABILITY LIMITATIONS AND INDEMNIFICATION

Section 5.01 — Limitation of Liability of SUKI.

(a) SUKI AS INFRASTRUCTURE PROVIDER ONLY. THE MERCHANT EXPRESSLY ACKNOWLEDGES, UNDERSTANDS, AND AGREES THAT SUKI IS, IN ALL CIRCUMSTANCES, STRICTLY AND EXCLUSIVELY A DIGITAL TECHNOLOGY INFRASTRUCTURE PROVIDER AND PLATFORM OPERATOR. SUKI IS NOT, IN ANY MANNER WHATSOEVER, A MERCHANT, RETAILER, SELLER, SERVICE PROVIDER, FOOD HANDLER, PRODUCT MANUFACTURER, OR SUPPLIER OF ANY GOODS OR SERVICES TO CUSTOMERS. SUKI MAKES NO REPRESENTATIONS, WARRANTIES, OR GUARANTEES OF ANY KIND, EXPRESS OR IMPLIED, WITH RESPECT TO THE QUALITY, SAFETY, FITNESS FOR PURPOSE, LEGALITY, OR ANY OTHER CHARACTERISTIC OF THE GOODS OR SERVICES OFFERED BY THE MERCHANT THROUGH OR IN CONNECTION WITH THE MERCHANT'S LOYALTY PROGRAM ON THE SUKI PLATFORM.

(b) DISCLAIMER OF WARRANTIES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE PHILIPPINE LAW, THE SUKI PLATFORM IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. SUKI EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, COMPLETENESS, TIMELINESS, AND UNINTERRUPTED OR ERROR-FREE OPERATION. SUKI DOES NOT WARRANT THAT THE SUKI PLATFORM WILL MEET THE MERCHANT'S SPECIFIC BUSINESS REQUIREMENTS OR EXPECTATIONS, THAT THE PLATFORM WILL OPERATE WITHOUT INTERRUPTION OR ERROR, OR THAT ANY DEFECTS IN THE PLATFORM WILL BE CORRECTED.

(c) CAP ON DIRECT DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE PHILIPPINE LAW, IN NO EVENT SHALL SUKI'S AGGREGATE LIABILITY TO THE MERCHANT FOR DIRECT DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY, EXCEED THE TOTAL AMOUNT OF SUBSCRIPTION FEES ACTUALLY PAID BY THE MERCHANT TO SUKI DURING THE THREE (3) CALENDAR MONTHS IMMEDIATELY PRECEDING THE EVENT OR OCCURRENCE GIVING RISE TO SUCH LIABILITY.

(d) EXCLUSION OF CONSEQUENTIAL DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE PHILIPPINE LAW, IN NO EVENT SHALL SUKI BE LIABLE TO THE MERCHANT OR TO ANY THIRD PARTY FOR ANY: (i) LOSS OF PROFITS, REVENUE, OR ANTICIPATED SAVINGS; (ii) LOSS OF BUSINESS, GOODWILL, OR REPUTATION; (iii) LOSS OF DATA OR DATA CORRUPTION; (iv) BUSINESS INTERRUPTION LOSSES; (v) INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES OF ANY NATURE; OR (vi) DAMAGES ARISING FROM THE MERCHANT'S INABILITY TO USE THE SUKI PLATFORM, EVEN IF SUKI HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF ANY REMEDY HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.

Section 5.02 — SUKI's Specific Non-Liability for Merchant Obligations. Without limiting the generality of Section 5.01, and without prejudice to any other limitation or exclusion of liability set forth in this Agreement, SUKI shall have absolutely no liability whatsoever — and the Merchant expressly, irrevocably, and unconditionally releases and holds SUKI harmless from any and all claims, demands, actions, suits, proceedings, losses, damages, costs, and expenses arising from — the following:

(a) Unfulfilled Rewards and Loyalty Obligations. Any failure, refusal, delay, or inability of the Merchant to honor, redeem, fulfill, or deliver any reward, benefit, discount, free item, promotional offer, or other loyalty incentive promised to Customers under the Merchant's loyalty program, whether arising from the Merchant's financial insolvency, operational closure, inventory depletion, policy change, or any other cause whatsoever;

(b) Merchant Insolvency or Bankruptcy. Any loss, harm, or injury suffered by Customers, creditors, employees, or other third parties arising from or in connection with the Merchant's bankruptcy, insolvency, receivership, dissolution, cessation of business, or any analogous proceeding under Philippine law, including in particular any claims by Customers whose accumulated digital stamps or unredeemed rewards are rendered valueless as a result of the Merchant's financial failure;

(c) DTI Regulatory Complaints. Any complaint, investigation, enforcement action, penalty, fine, or sanction imposed by the Department of Trade and Industry (DTI), the Consumer Arbitration Office (CAO), or any other government regulatory body, arising from or in connection with the Merchant's loyalty program, promotional campaigns, reward structures, product or service offerings, consumer relations practices, or any other aspect of the Merchant's commercial operations, regardless of whether the loyalty program is administered through the SUKI Platform;

(d) Consumer Complaints Regarding Goods and Services. Any claim, complaint, cause of action, or liability asserted by a Customer or other consumer arising from or related to the quality, safety, fitness for purpose, defectiveness, or any other characteristic of the goods, food, beverages, products, or services offered for sale or provided by the Merchant, whether or not such goods or services are in any way connected to the Merchant's loyalty program on the SUKI Platform;

(e) Personal Injury or Property Damage. Any personal injury (including death), illness, food poisoning, allergic reaction, property damage, or other harm suffered by any Customer or third party as a result of the Merchant's products, services, premises, employees, or operations;

(f) Merchant's Data Privacy Violations. Any liability, penalty, fine, sanction, or claim arising from the Merchant's failure to comply with its obligations as a Personal Information Controller under RA 10173, including any unauthorized collection, use, disclosure, or processing of Customer Personal Information by the Merchant, or any failure of the Merchant to implement adequate data security measures;

(g) Third-Party Claims Against the Merchant. Any claim, demand, or action by any third party (other than a Customer) against the Merchant arising from or in connection with the Merchant's commercial operations, the Merchant's loyalty program, or the Merchant's use of the SUKI Platform.

Section 5.03 — Merchant's Indemnification Obligation. The Merchant shall indemnify, defend, and hold harmless SUKI and its officers, directors, shareholders, employees, agents, licensors, successors, and assigns (collectively, the "SUKI Indemnitees") from and against any and all claims, demands, actions, suits, proceedings, investigations, losses, liabilities, damages, judgments, settlements, penalties, fines, costs, and expenses (including reasonable attorneys' fees and legal costs, expert witness fees, and costs of investigation) (collectively, "Losses") that any SUKI Indemnitee may suffer, incur, or become liable for as a result of, arising out of, or in connection with:

(a) The Merchant's breach of any representation, warranty, covenant, obligation, or agreement under this Agreement;

(b) The Merchant's violation of any Applicable Law in connection with the Merchant's use of the SUKI Platform or the operation of the Merchant's loyalty program;

(c) The Merchant's failure to fulfill any loyalty reward, benefit, or obligation to a Customer;

(d) Any claim by a Customer arising from or related to the Merchant's goods, services, premises, or operations;

(e) The Merchant's violation of any third party's Intellectual Property Rights through the Merchant's use of the SUKI Platform;

(f) The Merchant's infringement, misappropriation, or violation of any privacy right, data protection right, or other right of any Customer or data subject;

(g) Any DTI complaint, NPC investigation, or other regulatory action arising from the Merchant's commercial or data processing activities;

(h) Any fraudulent, deceptive, or misleading act or omission of the Merchant in connection with the Merchant's loyalty program;

(i) The Merchant's use of the SUKI Platform for any purpose not authorized under this Agreement; and

(j) The gross negligence or willful misconduct of the Merchant or its Authorized Users.

SUKI reserves the right, at the Merchant's cost, to assume the exclusive defense and control of any matter subject to indemnification by the Merchant under this Section 5.03. The Merchant shall not settle any claim subject to indemnification without SUKI's prior written consent, which shall not be unreasonably withheld.

ARTICLE VI — SERVICE LEVELS AND PLATFORM AVAILABILITY

Section 6.01 — Target Uptime. SUKI shall use commercially reasonable efforts to make the SUKI Platform available to the Merchant and its Customers on a twenty-four (24) hours per day, seven (7) days per week basis, with a target monthly uptime of ninety-nine percent (99%) calculated on a calendar month basis, excluding Scheduled Maintenance Windows as defined in Section 6.03. The Parties expressly acknowledge and agree that the target uptime commitment in this Section 6.01 does not constitute an absolute guarantee of uninterrupted Platform availability, and that temporary interruptions, degraded performance, or unavailability may occur due to causes within and beyond SUKI's control.

Section 6.02 — No Uptime Guarantee. NOTWITHSTANDING SECTION 6.01, SUKI MAKES NO WARRANTY, GUARANTEE, OR REPRESENTATION OF ANY KIND THAT THE SUKI PLATFORM WILL BE CONTINUOUSLY AVAILABLE, UNINTERRUPTED, ERROR-FREE, OR FREE FROM BUGS, VULNERABILITIES, OR DEFECTS. THE MERCHANT'S SOLE AND EXCLUSIVE REMEDY FOR ANY PERIOD OF PLATFORM UNAVAILABILITY CAUSED BY SUKI'S FAILURE TO MEET THE TARGET UPTIME IN SECTION 6.01 SHALL BE, AT SUKI'S SOLE DISCRETION, A PRORATED SERVICE CREDIT APPLIED TO THE MERCHANT'S NEXT BILLING PERIOD, SUBJECT TO THE MERCHANT SUBMITTING A VALID WRITTEN CLAIM TO SUKI WITHIN SEVEN (7) DAYS OF THE ALLEGED DOWNTIME INCIDENT. UNDER NO CIRCUMSTANCES SHALL PLATFORM DOWNTIME, UNAVAILABILITY, OR DEGRADED PERFORMANCE GIVE RISE TO A RIGHT OF THE MERCHANT TO TERMINATE THIS AGREEMENT, WITHHOLD SUBSCRIPTION FEES, OR SEEK DAMAGES FROM SUKI.

Section 6.03 — Scheduled Maintenance Windows. SUKI reserves the right to take the SUKI Platform, or any component thereof, offline for routine maintenance, upgrades, patches, security updates, database optimization, infrastructure changes, or other technical operations (collectively, "Scheduled Maintenance"). SUKI shall use commercially reasonable efforts to: (a) schedule Scheduled Maintenance during low-traffic periods (typically between 2:00 AM and 6:00 AM Philippine Standard Time); and (b) provide the Merchant with at least twenty-four (24) hours' prior notice of Scheduled Maintenance expected to exceed two (2) hours in duration, through the Merchant Dashboard notification system or via email to the Merchant's registered email address. SUKI shall have no liability for any unavailability during Scheduled Maintenance periods.

Section 6.04 — Force Majeure. In the event that the SUKI Platform becomes unavailable or its performance is materially impaired due to a Force Majeure Event, SUKI's obligations to maintain Platform availability under this Article VI shall be suspended for the duration of such Force Majeure Event, and SUKI shall have no liability to the Merchant for any resulting unavailability, degradation, or loss. SUKI shall notify the Merchant promptly of any Force Majeure Event affecting Platform availability, and shall resume normal operations as soon as reasonably practicable after the cessation of the Force Majeure Event.

Section 6.05 — Third-Party Infrastructure Dependency. The Merchant acknowledges that the SUKI Platform relies in part on third-party infrastructure providers, cloud hosting services, content delivery networks, telecommunications carriers, and other external service providers, and that the availability and performance of the SUKI Platform may be affected by the availability and performance of such third-party services. SUKI shall not be liable for any Platform unavailability or degradation caused by failures, outages, or interruptions of such third-party services.

ARTICLE VII — SUBSCRIPTION FEES AND PAYMENT TERMS

Section 7.01 — Subscription Fee Obligation. In consideration of the license and services granted by SUKI under this Agreement, the Merchant shall pay to SUKI the Subscription Fee applicable to the subscription plan selected by the Merchant during the registration process, or as subsequently modified by the Merchant through the Merchant Dashboard in accordance with the plan change procedures established by SUKI. The Subscription Fee shall be due and payable in advance at the commencement of each billing period (monthly or annually, as selected by the Merchant) in Philippine Pesos (PHP) or such other currency as SUKI may designate, through the payment methods accepted by SUKI.

Section 7.02 — Fee Changes. SUKI reserves the right to modify, revise, or increase the Subscription Fee at any time, subject to providing the Merchant with not less than thirty (30) days' prior written notice of any fee change. The Merchant's continued use of the SUKI Platform after the effective date of any fee change shall constitute the Merchant's acceptance of the revised Subscription Fee. If the Merchant does not agree to the revised Subscription Fee, the Merchant's sole remedy is to terminate this Agreement in accordance with Article XI prior to the effective date of the fee change.

Section 7.03 — Non-Refundability. All Subscription Fees paid to SUKI are strictly non-refundable, in whole or in part, under any circumstances, including upon termination of this Agreement by either Party for any reason, including the Merchant's early termination of the Agreement, SUKI's termination of the Agreement for cause, or any Force Majeure Event affecting Platform availability. The Merchant expressly waives any right to a refund of any Subscription Fees, including fees paid for any portion of a billing period during which the Platform is unavailable or during which the Merchant does not use the Platform.

Section 7.04 — Late Payment. In the event that any Subscription Fee is not paid in full when due, SUKI reserves the right to: (a) charge interest on the outstanding amount at the rate of two percent (2%) per month from the due date until the date of full payment; (b) suspend the Merchant's access to the SUKI Platform until all outstanding amounts are paid in full; and (c) terminate this Agreement in accordance with Article XI upon the Merchant's failure to cure a payment default within seven (7) days of SUKI's written notice thereof.

Section 7.05 — Taxes. The Merchant shall be solely responsible for all taxes, duties, levies, and assessments applicable to the Subscription Fees and to the Merchant's business operations, including value-added tax (VAT), percentage tax, withholding tax, and all other applicable Philippine national and local taxes. SUKI's invoices for Subscription Fees shall indicate applicable VAT, if any. The Merchant shall provide SUKI with all information and documentation necessary for SUKI to comply with its own tax obligations in connection with this Agreement.

ARTICLE VIII — ACCEPTABLE USE POLICY

Section 8.01 — Prohibited Uses. The Merchant is strictly, absolutely, and unconditionally prohibited from using the SUKI Platform, the Merchant Dashboard, or any related service or infrastructure provided by SUKI for any of the following purposes, whether directly or indirectly, whether through its Authorized Users or through any other means:

(a) Illegal Goods and Services. To promote, advertise, sell, distribute, or facilitate the sale or distribution of any goods, substances, or services that are illegal, prohibited, controlled, or regulated under Philippine law, including without limitation: illegal drugs and controlled substances (as defined under Republic Act No. 9165, the Comprehensive Dangerous Drugs Act of 2002); firearms and ammunition (except by duly licensed dealers); counterfeit goods and products infringing third-party intellectual property rights; endangered species or products derived therefrom; items prohibited from sale under BFAD (now FDA) regulations; and any other goods or services the sale or promotion of which is prohibited or restricted by Philippine law;

(b) Fraudulent and Deceptive Practices. To engage in any fraudulent, deceptive, misleading, manipulative, or unfair commercial practice in connection with the Merchant's loyalty program, including without limitation: misrepresenting the value, availability, or terms of loyalty rewards; creating false urgency or scarcity to induce Customer participation; manipulating stamp counts or redemption records; and any other practice prohibited under the Consumer Act of the Philippines (RA 7394) or the DTI's regulations on sales promotions;

(c) Spam and Unauthorized Communications. To send unsolicited commercial communications, spam, phishing messages, or other unauthorized communications to Customers through any medium, including through the SUKI Platform's messaging features, in violation of RA 10173, the Cybercrime Prevention Act (RA 10175), or other applicable laws;

(d) Platform Interference. To interfere with, disrupt, damage, disable, overburden, or impair the SUKI Platform or its infrastructure, including through the use of malware, viruses, denial-of-service attacks, or other malicious tools or techniques;

(e) Unauthorized Data Processing. To collect, process, use, or disclose Customer Personal Information in any manner not authorized by this Agreement, Document 3, or Applicable Law, or to process Customer Personal Information for any purpose not disclosed to and consented to by the Customer;

(f) Misrepresentation of SUKI Affiliation. To represent or imply to Customers, prospective customers, business partners, investors, or the public that the Merchant is affiliated with, endorsed by, or acting as an agent or representative of SUKI in any capacity beyond that of a subscribing merchant; and

(g) Any Other Illegal or Harmful Purpose. To use the SUKI Platform for any purpose that is illegal, harmful, tortious, or contrary to public policy or morals under Philippine law.

Section 8.02 — SUKI's Right to Suspend for AUP Violations. SUKI reserves the right, in its sole and absolute discretion, to immediately suspend or terminate the Merchant's access to the SUKI Platform, without prior notice and without liability to the Merchant, upon SUKI's reasonable determination that the Merchant has violated or is in violation of any provision of this Article VIII. Such suspension or termination shall not relieve the Merchant of its obligation to pay any outstanding Subscription Fees.

ARTICLE IX — CONFIDENTIALITY

Section 9.01 — Confidentiality Obligations. Each Party (as a "Receiving Party") undertakes to: (a) hold the other Party's (as the "Disclosing Party's") Confidential Information in strict confidence; (b) use the Disclosing Party's Confidential Information solely for the purposes of exercising its rights and fulfilling its obligations under this Agreement; (c) not disclose the Disclosing Party's Confidential Information to any third party without the Disclosing Party's prior written consent, except to the Receiving Party's own employees, officers, agents, or professional advisors who have a need to know such information for purposes of this Agreement and are bound by confidentiality obligations at least as protective as those in this Agreement; and (d) protect the Disclosing Party's Confidential Information using at least the same degree of care as the Receiving Party uses to protect its own most sensitive confidential information, but in no event less than a reasonable degree of care.

Section 9.02 — Survival of Confidentiality Obligations. The confidentiality obligations of the Parties under this Article IX shall survive the termination or expiration of this Agreement for a period of five (5) years thereafter, except with respect to any trade secrets of a Party, which shall be protected in perpetuity.

ARTICLE X — REPRESENTATIONS AND WARRANTIES

Section 10.01 — Merchant's Representations and Warranties. The Merchant represents and warrants to SUKI, as of the Effective Date and throughout the Subscription Term, that:

(a) The Merchant is a duly organized and validly existing legal entity or natural person with full legal capacity to enter into and perform this Agreement;

(b) The Merchant has obtained all necessary business permits, licenses, registrations, and authorizations required under Applicable Law to operate its business and to conduct the loyalty program contemplated by this Agreement;

(c) The Merchant has the full power and authority to execute and perform this Agreement, and the person completing the SUKI merchant registration process on behalf of the Merchant has been duly authorized to bind the Merchant to the terms of this Agreement;

(d) This Agreement constitutes the legal, valid, and binding obligation of the Merchant, enforceable against the Merchant in accordance with its terms;

(e) The Merchant's execution and performance of this Agreement does not violate any other agreement to which the Merchant is a party or any Applicable Law;

(f) All information submitted by the Merchant during the SUKI registration process is true, accurate, current, and complete; and

(g) The Merchant will, throughout the Subscription Term, comply with all Applicable Laws in connection with the Merchant's use of the SUKI Platform and the operation of the Merchant's loyalty program.

Section 10.02 — SUKI's Representations and Warranties. SUKI represents and warrants to the Merchant, as of the Effective Date and throughout the Subscription Term, that:

(a) SUKI is duly organized and validly existing under the laws of the Republic of the Philippines, with full legal capacity to enter into and perform this Agreement;

(b) This Agreement constitutes the legal, valid, and binding obligation of SUKI, enforceable against SUKI in accordance with its terms; and

(c) SUKI will, throughout the Subscription Term, use commercially reasonable efforts to operate and maintain the SUKI Platform in a manner consistent with the service standards described in Article VI.

ARTICLE XI — TERM AND TERMINATION

Section 11.01 — Subscription Term. This Agreement shall commence on the Effective Date and shall continue for the initial subscription period selected by the Merchant during the registration process (the "Initial Term"), and shall automatically renew for successive renewal periods of the same duration as the Initial Term (each, a "Renewal Term") unless either Party provides written notice of non-renewal to the other Party not less than thirty (30) days prior to the expiration of the then-current Initial Term or Renewal Term, as applicable.

Section 11.02 — Termination for Cause by SUKI. SUKI may terminate this Agreement immediately upon written notice to the Merchant, without liability to the Merchant, upon the occurrence of any of the following events:

(a) The Merchant's material breach of any provision of this Agreement, if such breach is not capable of remedy or if, being capable of remedy, the Merchant fails to remedy such breach within fourteen (14) days of SUKI's written notice describing the breach in reasonable detail;

(b) The Merchant's violation of any provision of the Acceptable Use Policy;

(c) The Merchant's failure to pay any Subscription Fee within seven (7) days of its due date, after SUKI has provided the Merchant with written notice of such non-payment;

(d) The Merchant's insolvency, bankruptcy, receivership, voluntary or involuntary winding up, or cessation of business operations;

(e) SUKI's determination, in its sole and absolute discretion, that the Merchant's continued use of the SUKI Platform poses a risk to the integrity, security, or reputation of the SUKI Platform or to the rights or safety of other users; or

(f) Any requirement of Applicable Law or regulatory authority that makes it unlawful for SUKI to continue providing the SUKI Platform to the Merchant.

Section 11.03 — Termination for Convenience by Merchant. The Merchant may terminate this Agreement at any time upon thirty (30) days' prior written notice to SUKI, provided that: (a) all outstanding Subscription Fees due and payable up to the effective date of termination shall be immediately due and payable; (b) no refund shall be issued for any Subscription Fees paid in advance for any period after the effective date of termination; and (c) the Merchant complies with all post-termination obligations set forth in Section 11.05.

Section 11.04 — Effect of Termination. Upon the termination or expiration of this Agreement for any reason: (a) all licenses granted to the Merchant under Article II shall immediately and automatically terminate; (b) the Merchant shall immediately cease all use of the SUKI Platform, the Merchant Dashboard, and all associated services; (c) the Merchant shall immediately cease displaying SUKI QR codes or access codes to its customers; and (d) the Merchant's loyalty program on the SUKI Platform shall be deactivated and will no longer be accessible to Customers.

Section 11.05 — Post-Termination Data Handling Protocols.

(a) Data Export. Within thirty (30) days after the effective date of termination, SUKI shall make available to the Merchant, for a period of thirty (30) days from notification, a one-time data export of all Customer Personal Information and Customer Transaction Data attributable to the Merchant's loyalty program, in a structured, commonly used, machine-readable format (such as CSV or JSON), through the Merchant Dashboard or by such other means as SUKI may reasonably designate. The Merchant shall be solely responsible for downloading and securely storing the exported data. SUKI shall have no obligation to retain the Merchant's Customer Personal Information or Customer Transaction Data for longer than sixty (60) days after the effective date of termination.

(b) Data Deletion. Upon the earlier of: (i) sixty (60) days after the effective date of termination; or (ii) the Merchant's written confirmation that it has successfully exported its data, SUKI shall securely delete and destroy all Customer Personal Information and Customer Transaction Data attributable to the Merchant's loyalty program from the SUKI Platform's primary databases, subject to: (A) SUKI's right to retain Aggregated Analytics Data in perpetuity pursuant to Section 3.04; (B) any retention obligation imposed by Applicable Law (including tax record retention requirements); and (C) the retention of data in routine system backups, which backups shall be overwritten or deleted in accordance with SUKI's standard backup rotation schedule.

(c) Merchant's Post-Termination PIC Obligations. Upon termination of this Agreement and the export of Customer Personal Information, the Merchant, as Personal Information Controller of such data, shall be solely and exclusively responsible for the lawful and compliant handling, storage, use, and ultimate deletion of such data in accordance with RA 10173 and applicable NPC regulations. SUKI shall have no further obligations as Personal Information Processor with respect to such data.

Section 11.06 — Survival. The following provisions of this Agreement shall survive the termination or expiration of this Agreement for any reason: Sections 3.01–3.04 (Intellectual Property Rights); Section 3.05 (Feedback); Section 4.04 (Audit Rights, to the extent of any pending audit commenced prior to termination); Article V (Liability Limitations and Indemnification); Article IX (Confidentiality); Section 11.05 (Post-Termination Data Handling); Section 11.06 (Survival); Article XII (Dispute Resolution); and Article XIII (General Provisions).

ARTICLE XII — DISPUTE RESOLUTION

Section 12.01 — Governing Law. This Agreement shall be governed by, construed in accordance with, and enforced under the laws of the Republic of the Philippines, without regard to any conflict of laws principles that would result in the application of the laws of any other jurisdiction.

Section 12.02 — Negotiation. In the event of any dispute, controversy, or claim arising out of or relating to this Agreement, or the breach, termination, or invalidity thereof (a "Dispute"), the Parties shall first attempt to resolve such Dispute through good faith negotiation between senior representatives of the Parties. Either Party may initiate the negotiation process by delivering written notice to the other Party describing the Dispute in reasonable detail. The Parties shall have thirty (30) days from the delivery of such notice to resolve the Dispute through negotiation. If the Dispute is not resolved within such thirty (30) day period, either Party may proceed to mediation as provided in Section 12.03.

Section 12.03 — Mediation. If the Parties are unable to resolve a Dispute through negotiation, the Parties shall, prior to initiating any arbitration or court proceeding, submit the Dispute to non-binding mediation administered by the Philippine Dispute Resolution Center, Inc. (PDRCI) or such other mutually agreed mediation institution, in accordance with the applicable mediation rules of such institution. The mediation shall be conducted in Metro Manila, in the English language. The cost of the mediator shall be borne equally by the Parties. If the Dispute is not resolved through mediation within sixty (60) days of the commencement of mediation proceedings, either Party may proceed to arbitration as provided in Section 12.04.

Section 12.04 — Arbitration. All Disputes not resolved through negotiation or mediation shall be finally and exclusively resolved by binding arbitration administered by the Philippine Dispute Resolution Center, Inc. (PDRCI), or, if agreed in writing by the Parties, the International Chamber of Commerce (ICC), in accordance with the applicable arbitration rules of the chosen institution, as modified by this Section 12.04. The arbitration shall be conducted by a sole arbitrator mutually agreed upon by the Parties, or if the Parties cannot agree, appointed in accordance with the applicable rules. The arbitration shall be conducted in Metro Manila, Republic of the Philippines, in the English language. The arbitration award shall be final and binding upon the Parties and shall be enforceable in any court of competent jurisdiction. Each Party shall bear its own costs of arbitration, and the arbitrator's fees shall be shared equally by the Parties, unless the arbitration award provides otherwise. Notwithstanding the foregoing, either Party may seek emergency injunctive or interim relief from a court of competent jurisdiction in Metro Manila to prevent irreparable harm or to preserve the status quo pending the resolution of a Dispute through arbitration.

ARTICLE XIII — GENERAL PROVISIONS

Section 13.01 — Entire Agreement. This Agreement, together with all schedules, exhibits, annexes, addenda, and all documents expressly incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof, and supersedes all prior and contemporaneous agreements, understandings, negotiations, representations, and communications, whether oral or written, between the Parties relating to the subject matter hereof.

Section 13.02 — Amendments. SUKI reserves the right to amend, modify, or update this Agreement at any time, in its sole and absolute discretion, by posting the amended Agreement on the SUKI Platform or Merchant Dashboard and/or by notifying the Merchant via email to the Merchant's registered email address. The Merchant's continued use of the SUKI Platform after the effective date of any amendment shall constitute the Merchant's unconditional acceptance of the amended Agreement. If the Merchant does not agree to an amendment, the Merchant's sole remedy is to terminate this Agreement in accordance with Article XI.

Section 13.03 — Severability. If any provision of this Agreement is found by a court or arbitral tribunal of competent jurisdiction to be invalid, illegal, or unenforceable, such provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable, and the validity, legality, and enforceability of all other provisions of this Agreement shall not be affected or impaired in any way.

Section 13.04 — Waiver. No failure or delay by either Party to exercise any right or remedy under this Agreement shall constitute a waiver of such right or remedy. No single or partial exercise of any right or remedy shall preclude or restrict the further exercise of such or any other right or remedy. No waiver of any provision of this Agreement shall be effective unless in writing signed by the waiving Party.

Section 13.05 — No Assignment. The Merchant may not assign, transfer, sublicense, delegate, or otherwise dispose of any of its rights or obligations under this Agreement, in whole or in part, whether by operation of law, change of control, merger, asset sale, or otherwise, without SUKI's prior written consent. SUKI may assign or transfer this Agreement, in whole or in part, to any successor entity or affiliate without the Merchant's consent, provided that such assignment does not materially diminish the Merchant's rights under this Agreement.

Section 13.06 — Notices. All notices, demands, requests, consents, approvals, and other communications under this Agreement shall be in writing and shall be delivered: (a) by hand delivery; (b) by registered mail with return receipt requested to the physical address on file; (c) by nationally recognized overnight courier to the address on file; or (d) by email to the registered email address of the receiving Party. Notices shall be deemed delivered: upon personal delivery; three (3) Business Days after deposit with registered mail; one (1) Business Day after delivery to an overnight courier; or upon electronic confirmation of receipt in the case of email.

Section 13.07 — Language. This Agreement is written in the English language. In the event of any conflict or inconsistency between any English-language version of this Agreement and any translation thereof, the English-language version shall prevail.

Section 13.08 — Counterparts and Electronic Signatures. This Agreement may be accepted electronically, by the Merchant's affirmative click on the "I Agree" or equivalent acceptance button during the SUKI merchant registration process, which electronic acceptance shall have the same legal force and effect as a handwritten signature, in accordance with Republic Act No. 8792 (Electronic Commerce Act of 2000) and applicable regulations.

SCHEDULE A — DATA PROCESSING DETAILS

Annex to Article IV — Data Processing Agreement

A.1 — Subject Matter of Processing. The processing of Customer Personal Information by SUKI as Personal Information Processor on behalf of the Merchant as Personal Information Controller, in connection with the operation of the Merchant's digital loyalty program on the SUKI Platform.

A.2 — Duration of Processing. For the duration of the Subscription Term and for such period thereafter as may be required by this Agreement or Applicable Law, but in no event exceeding sixty (60) days after the effective date of termination, except for Aggregated Analytics Data retained by SUKI in perpetuity pursuant to Section 3.04.

A.3 — Nature and Purpose of Processing. Collection, recording, storage, organization, structuring, retrieval, consultation, use, disclosure, and deletion of Customer Personal Information for the purpose of: operating the Merchant's digital loyalty stamp program; issuing, tracking, and validating digital stamps; processing reward redemptions; generating analytics and reports for the Merchant; enabling Customer communications authorized under this Agreement and Document 3; and performing all other functions of the SUKI Platform as used by the Merchant.

A.4 — Types of Personal Information. Email addresses; mobile phone numbers (where provided); names (where provided); loyalty program participation data (stamp counts, redemption records); transaction timestamps; geolocation data of loyalty events (where consented to); referral network connections; device identifiers and browser information.

A.5 — Categories of Data Subjects. Natural persons who have registered as users of the SUKI Platform and who have enrolled in the Merchant's specific loyalty program.

A.6 — Sub-Processors. SUKI may engage third-party sub-processors (including cloud hosting, database, and communications service providers) to assist in the processing of Customer Personal Information. A current list of SUKI's sub-processors is available upon written request by the Merchant. SUKI shall impose data protection obligations on all sub-processors that are equivalent to those imposed on SUKI under this Agreement and under RA 10173.

End of Document 1 — SUKI Master Subscription and Platform Agreement

By completing the digital registration process and clicking "I Agree," the Merchant acknowledges that it has read, understood, and unconditionally agrees to be legally bound by all terms and conditions of this Agreement.