Loyalty Module — Terms & Conditions

Global B2B Addendum to the Kayana Merchant / Customer Agreement.

Effective from: 14 July 2026

1. Introduction and Contracting Entity

1. This Kayana Loyalty Module Terms & Conditions (this "Addendum") supplements and forms part of the underlying agreement between the relevant Kayana Group entity ("Kayana") and the customer operating a venue on a Kayana product (the "Customer" or "Venue") that governs the Customer's use of Kayana EPOS, Kayana Kiosk, Kayana Web Admin, and/or Kayana Online Ordering (the "Principal Agreement"). Capitalised terms not defined here have the meaning given in the Principal Agreement.

2. The Kayana entity that is party to this Addendum is the Kayana Group entity identified against the Customer's billing country in Schedule A (Contracting Entity Matrix). Each such entity contracts independently as principal, not as agent for any other Kayana Group entity, and each Customer's rights and obligations run solely to and from its contracting entity.

3. Where a Customer operates Venues in more than one country, the Customer will hold a separate Order Form and be bound by a separate contracting entity for each country of operation, and this Addendum applies separately in each case, subject to the jurisdiction-specific variations in Schedule B.

2. Definitions

Loyalty Module — The loyalty, rewards, points-accrual and points-redemption feature made available by Kayana as an optional add-on to the Kayana platform.

Loyalty Points — The non-monetary units of value issued by the Venue to its end consumers ("Diners") through the Loyalty Module, as configured by the Venue.

Diner — An individual end consumer of a Venue who enrols in, accrues, or redeems Loyalty Points.

Program — The specific loyalty scheme configured and operated by the Venue using the Loyalty Module, including its rules, tiers, accrual rates, expiry rules and rewards catalogue.

Kayana Group — Kayana World Limited and its subsidiaries and affiliates listed in Schedule A.

Diner Data — personal data of Diners collected, processed or stored through the Loyalty Module in connection with a Program.

Order Form — the ordering document, in-product purchase flow, or equivalent record by which a Customer elects to enable the Loyalty Module.

Business Day — a day other than a Saturday, Sunday or public holiday in the jurisdiction of the Customer's contracting Kayana entity per Schedule A.

3. Scope of the Loyalty Module

4. The Loyalty Module allows the Venue to configure and operate its own Program for its Diners, including points accrual rules, tiers, redemption rewards, and expiry settings, using tools made available within Kayana Web Admin and reflected at point of sale in Kayana EPOS, Kayana Kiosk and Kayana Online Ordering.

5. The Venue is the operator of its Program and is solely responsible for: (a) the design, legality, and marketing of its Program in each jurisdiction in which it operates; (b) setting and honouring accrual and redemption rules communicated to Diners; and (c) all tax, accounting, and consumer-facing disclosure obligations arising from its Program.

6. Kayana provides the technology platform only. Kayana is not the operator of any Venue's Program and is not a party to the relationship between a Venue and its Diners.

4. Enablement, Term and Termination

7. The Loyalty Module is enabled upon the Customer's election in its Order Form or in-product purchase flow, and this Addendum takes effect on the date of enablement ("Loyalty Effective Date").

8. This Addendum continues for as long as the Loyalty Module remains enabled on the Customer's account and terminates automatically on termination or expiry of the Principal Agreement, or earlier on either party disabling the Loyalty Module in accordance with the applicable notice period stated in the Order Form or in accordance with clause 9.

9. Either party may terminate this Addendum for the other party's uncured material breach of this Addendum by giving not less than 30 days' written notice specifying the breach, if the breach remains unremedied at the expiry of that notice period. Termination of this Addendum under this clause does not, of itself, terminate the Principal Agreement.

10. On termination, Kayana will make Program configuration and accrued Loyalty Points data available for export for 30 days, after which Kayana may delete such data in accordance with its data retention policy and Schedule B data protection requirements. Where the Loyalty Module is disabled but the Principal Agreement continues, the Venue remains solely responsible for notifying its Diners of any resulting change to Program terms, including any expiry or forfeiture of Loyalty Points, in accordance with the Venue's own Diner-facing terms and applicable consumer protection law.

5. Fees

11. Fees for the Loyalty Module are as set out in the Customer's Order Form or the then-current Kayana price list for the Customer's region, and are payable in accordance with the payment terms of the Principal Agreement. Unless expressly stated otherwise, fees are exclusive of VAT, GST, sales tax or other equivalent tax, which the Customer shall pay in addition at the applicable rate.

12. Kayana may vary Loyalty Module fees on renewal, on no less than 30 days' prior written notice. Australia: see Schedule B — unilateral fee variation clauses in standard-form small-business contracts are subject to the unfair contract terms regime and must permit the Customer a right to terminate without penalty if it does not accept a fee increase.

6. Amendments to this Addendum

13. Except as set out in clause 12 (Fees), this Addendum may only be amended by written agreement of both parties, or unilaterally by Kayana on not less than 30 days' notice where reasonably necessary to reflect a change in applicable law, regulatory guidance, or Kayana's data processing arrangements. Where an amendment made unilaterally under this clause is materially adverse to the Customer, the Customer may terminate the Loyalty Module without penalty by written notice given before the amendment takes effect.

7. Customer / Venue Responsibilities

The Venue shall:

• ensure its Program, its terms as presented to Diners, and its marketing comply with all applicable consumer protection, marketing, prize/promotion, gift-card, e-money, and data protection laws in each jurisdiction in which the Venue operates;
• obtain and maintain all consents from Diners required to collect and process Diner Data, and provide Diners with a clear, accessible Program terms and privacy notice;
• not represent to Diners that Loyalty Points are redeemable for cash, are a deposit, or are protected/insured in any way unless independently confirmed as compliant with applicable e-money/payments law;
• honour Loyalty Points accrued by Diners in accordance with its published Program rules, including on expiry of the Loyalty Module or termination of the Principal Agreement, to the extent required by applicable consumer protection law;
• provide Kayana, on reasonable request, with evidence that its Program complies with applicable law, to enable Kayana to assess its rights under clause 32 (Suspension).

8. Nature of Loyalty Points

14. Loyalty Points are not currency, e-money, a deposit, a security, or a financial product. Loyalty Points have no cash value, are non-transferable between Diners, and are not redeemable for cash except where a Venue's Program expressly and lawfully permits this and the Venue has independently confirmed such a feature's regulatory status in its jurisdiction (see Schedule B).

15. Kayana has no liability to any Diner for the issuance, expiry, forfeiture, or redemption of Loyalty Points. All such liability rests with the Venue as Program operator.

16. Expiry and breakage rules for unredeemed Loyalty Points are set by the Venue subject to mandatory minimums under local consumer protection law referenced in Schedule B (for example, certain US states and Australian states restrict or prohibit expiry of paid-for credit; Loyalty Points that are earned free of charge are typically treated differently — Venue to confirm with local counsel before setting expiry rules).

9. Data Protection and Privacy

17. As between Kayana and the Venue, the Venue is the controller (or equivalent term under local law) of Diner Data and Kayana is the processor (or equivalent), processing Diner Data solely to provide the Loyalty Module and otherwise in accordance with the Kayana Data Processing Addendum incorporated by reference into the Principal Agreement.

18. Each party shall comply with the data protection law applicable to it in respect of Diner Data, as identified per jurisdiction in Schedule B.

19. Where Diner Data is transferred across a border identified in Schedule B as requiring a specific safeguard (for example, EU/UK Standard Contractual Clauses, or a Quebec Law 25 transfer impact assessment), the parties shall execute or complete that safeguard before such transfer begins. For transfers of Diner Data out of the EEA or UK, this safeguard is already in place: the EU/UK Standard Contractual Clauses (or, for UK transfers, the UK International Data Transfer Addendum) are incorporated by reference into the Kayana Data Processing Addendum described in clause 17, and do not require separate execution for each transfer route.

19A. For a Venue with Quebec-domiciled Diners, Kayana additionally: (a) shall use Diner Data solely to provide the Loyalty Module and for no other purpose; (b) shall implement security safeguards appropriate to the sensitivity of Diner Data; (c) shall not retain Diner Data longer than necessary to fulfil that purpose, and shall destroy or anonymise it following termination of this Addendum, subject to clause 10; and (d) shall give the Venue reasonable advance notice before transferring Diner Data outside Quebec, to allow the Venue to complete any Privacy Impact Assessment or transfer assessment required under Quebec's Act respecting the protection of personal information in the private sector.

20. Each party shall notify the other without undue delay on becoming aware of any actual or reasonably suspected unauthorised access to, or loss of, Diner Data, and in any event Kayana shall notify the Venue within 72 hours of becoming aware of such an event. The parties shall cooperate in good faith on any resulting investigation, regulatory notification, or Diner communication, with the Venue retaining sole responsibility for any Diner-facing notification required by applicable law.

21. Where Kayana receives a request directly from a Diner to exercise a data protection right in respect of Diner Data, Kayana will forward that request to the Venue promptly and will provide the Venue with reasonable assistance in responding to it, consistent with the Kayana Data Processing Addendum.

10. Intellectual Property

22. Kayana retains all right, title and interest in the Loyalty Module, its software, and all improvements, other than the Venue's own Program configuration, branding, and Diner Data, which remain the Venue's property.

23. The Venue grants Kayana a limited licence to use the Venue's name, logo and Program configuration solely to operate the Loyalty Module and, unless the Venue opts out, to reference the Venue as a customer in Kayana marketing.

24. The Venue warrants that it holds all rights necessary to grant the licence in clause 23, and that Kayana's use of the Venue's name, logo and Program configuration in accordance with that clause will not infringe a third party's rights.

25. If the Venue provides Kayana with suggestions, ideas or feedback about the Loyalty Module, Kayana may use them without restriction or obligation to the Venue.

11. Confidentiality

Each party shall keep confidential the other's non-public business, technical and Program information, and use it only to perform this Addendum, consistent with the confidentiality provisions of the Principal Agreement.

12. Warranties and Disclaimers

26. Kayana warrants that it will provide the Loyalty Module with reasonable skill and care and in substantial conformity with its published documentation.

27. Except as expressly stated, the Loyalty Module is provided "as is" and Kayana disclaims all other warranties to the maximum extent permitted by applicable law. Some jurisdictions do not permit the exclusion of certain statutory guarantees (for example, Australian Consumer Law consumer guarantees, and equivalent New Zealand and EU consumer-protection guarantees) — nothing in this Addendum excludes a guarantee or right that cannot lawfully be excluded, and Schedule B identifies where this applies.

13. Limitation of Liability

28. Subject to clause 29, each party's aggregate liability arising out of or in connection with the Loyalty Module is capped in accordance with the liability cap set out in the Principal Agreement.

29. Nothing in this Addendum limits or excludes either party's liability for death or personal injury caused by negligence, fraud, or any liability that cannot lawfully be limited or excluded in the relevant jurisdiction listed in Schedule A.

14. Indemnification

30. The Venue shall indemnify Kayana against third-party claims (including from Diners or regulators) arising from the Venue's Program design, its non-compliance with applicable consumer protection, marketing, prize/promotion or data protection law, or its misrepresentation of Loyalty Points to Diners. Kayana shall indemnify the Venue against third-party claims that the Loyalty Module, as provided by Kayana and used in accordance with this Addendum, infringes a third party's intellectual property rights.

31. The indemnification obligations in clause 30 are subject to the following procedure:

• the party seeking indemnification ("Indemnified Party") shall promptly notify the other party ("Indemnifying Party") in writing of any claim, provided that a delay in notice only relieves the Indemnifying Party of its obligations to the extent it is prejudiced by the delay;
• the Indemnifying Party shall have control of the defence and settlement of the claim, using counsel of its choosing, and the Indemnified Party shall provide reasonable cooperation at the Indemnifying Party's expense;
• the Indemnified Party may participate in the defence with its own counsel at its own cost; and
• the Indemnifying Party shall not settle a claim in a way that admits fault on the part of, or imposes any non-monetary obligation on, the Indemnified Party without the Indemnified Party's prior written consent, not to be unreasonably withheld.

30A. For a Venue that is a "small business" for the purposes of the Australian Consumer Law unfair contract terms regime (broadly, an entity with fewer than 100 employees or turnover under A$10 million), the indemnification in clause 30 is limited to loss arising from the Venue's own breach of applicable law, misrepresentation to Diners, or unlawful Program design, and does not extend to loss caused by Kayana's negligence, wilful misconduct, or breach of this Addendum.

15. Suspension and Termination for Cause

32. Kayana may suspend the Loyalty Module on reasonable notice (or immediately in the case of a security risk, suspected fraud, or a Venue's Program being unlawful in its jurisdiction) until the relevant issue is resolved, without prejudice to either party's right to terminate this Addendum under clause 9.

32A. For a Venue that is a "small business" for the purposes of the Australian Consumer Law unfair contract terms regime, Kayana will give the Venue not less than 14 days' notice and a reasonable opportunity to remedy the relevant issue before suspending the Loyalty Module under clause 32, except where Kayana reasonably believes there is an imminent security risk, active fraud, or a legal obligation to act immediately.

16. Compliance, Anti-Bribery and Sanctions

33. Each party shall comply with anti-bribery and anti-corruption laws applicable to it, including the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act, and shall not offer, give, request or accept any improper payment or benefit in connection with this Addendum.

34. Each party confirms that it is not, and shall not engage in any Program activity that would cause the other party to be, in breach of applicable trade sanctions or export control restrictions.

35. Without prejudice to clause 32, Kayana may suspend the Loyalty Module immediately if it reasonably believes a Venue's Program is being used for money laundering, sanctions evasion, or other unlawful financial activity.

17. General Provisions

Notices: any formal notice under this Addendum must be given in writing to the address or email address specified in the Order Form (or such other address as a party later notifies to the other), and is deemed received: (a) if delivered by hand, on delivery; (b) if sent by email, on the next Business Day after sending, provided no delivery-failure notification is received; (c) if sent by registered post, five Business Days after posting.

Waiver: no failure or delay by a party in exercising a right under this Addendum operates as a waiver of that right, and no waiver is effective unless in writing and signed by the waiving party.

Relationship of the parties: this Addendum does not create a partnership, joint venture, agency, franchise, or employment relationship between Kayana and the Venue, and neither party has authority to bind the other.

Third-party rights: save for a Kayana Group entity's own right to enforce this Addendum as described in clause 2, a person who is not a party to this Addendum — including a Diner — has no right to enforce any term of this Addendum, whether under the Contracts (Rights of Third Parties) Act 1999 or an equivalent local law, and nothing in this Addendum creates a contractual relationship between Kayana and any Diner.

Survival: clauses 14–16 (Nature of Loyalty Points), 17–21 including 19A (Data Protection and Privacy, in respect of data export, deletion and post-termination obligations), 22–25 (Intellectual Property), Section 11 (Confidentiality), 28–29 (Limitation of Liability), 30–31 including 30A (Indemnification), and this Section 17 and Section 18 (Governing Law) survive termination or expiry of this Addendum, together with any other clause which by its nature is intended to survive.

Assignment: neither party may assign this Addendum without the other's consent, except to an affiliate or successor on a merger, acquisition, or sale of substantially all assets.

Force majeure: neither party is liable for delay or failure caused by events beyond its reasonable control.

Severability: if a provision is held unenforceable in a given jurisdiction, the remainder of this Addendum continues in effect in that jurisdiction, and the unenforceable provision is replaced with one giving effect to the parties' original intent to the extent permitted by local law.

Entire agreement: this Addendum, together with the Principal Agreement and Schedules A–B, is the entire agreement between the parties regarding the Loyalty Module.

Language: the English-language version of this Addendum is the governing version, save where Schedule B identifies a jurisdiction requiring a local-language version for enforceability, in which case the local-language version governs solely for that jurisdiction's Venues.

18. Governing Law and Dispute Resolution

This Addendum is governed by the law, and subject to the courts (or arbitral forum, where the Order Form so specifies), identified against the applicable Kayana contracting entity in Schedule A.

Schedule A — Contracting Entity Matrix

Schedule B — Jurisdiction-Specific Mandatory Variations