VIP Entrance Platform Licence Agreement and Operating Terms

1-1  Contract documents

The following documents form an integral part of this contract and are read together with it:

• This contract and any appendices or written amendments to it.
• The packages and prices published on the packages page at the time of subscription.
• The general Terms and Conditions of the Company's platforms.
• The Privacy Policy adopted by the Company.
• The tax invoices issued by the Company to the Subscriber.

1-2  Order of precedence

Where these documents conflict, precedence is given to the text of this contract, then to the package and price recorded on the tax invoice, then to the general Terms and Conditions, then to the Privacy Policy.

1-3  Legal references

This contract is governed by the laws in force in the Kingdom of Saudi Arabia, and in particular:

• The Civil Transactions Law and its implementing regulations.
• The Personal Data Protection Law (PDPL) and its implementing regulations.
• The E-Commerce Law and its implementing regulations.
• The Electronic Transactions Law and the Anti-Cyber Crime Law.
• The VAT Law and the e-invoicing regulations issued by the Zakat, Tax and Customs Authority.

2-1  Nature of the licence

The Company grants the Subscriber a personal, non-exclusive licence, not transferable or sub-licensable, limited to the term of the subscription in force, to use the VIP Entrance platform in operating its business. This licence conveys no ownership right in the platform, its source code, its designs or its trademarks.

2-2  Modules covered by the licence

• Subscriber dashboard: managing establishment data, branches, users and permissions, and following up bookings and revenue.
• Service management and public QR pages: creating services and setting their prices, times and capacity, and generating a public page and a QR code for each service.
• End-user booking portal: the booking interface and identity verification by one-time code, and end-user payment where the Subscriber has enabled online payment.
• Field scanning screen: the interface used by the Subscriber's staff at the point of entry to verify a booking and record actual entry.
• Reports and reviews: booking, entry and revenue reports, and receiving and displaying end-user reviews.
• Marketing tools: promo codes and offers attached to the Subscriber's services, within the limits of the subscribed package.

2-3  Limits of scope

The Company's responsibility is limited to making the platform available and operating it. The service that the Subscriber publishes and delivers to its end users — its content, price, quality and safe performance — is the sole responsibility of the Subscriber; the Company is neither a party to it nor a provider of it.

2-4  Development and updates

The Company may develop the platform and add modules or modify its interfaces in a manner that does not materially impair the contracted functions, without any additional charge to the Subscriber during the subscription term in force.

3-1  Acknowledgement of inspection

The Subscriber acknowledges that it has reviewed the platform and tried its functions — including the free trial period available to it — and inspected it in a manner that removes any uncertainty, and that it accepted it in its present state with the features and limits it contains.

3-2  Adequacy of consideration

The Subscriber acknowledges that the subscription value set out in Article Seven is fair and sufficient consideration for the licence, services and technical support it receives, and that it may not claim a reduction based on its actual level of use of the platform.

3-3  Operating requirements on the Subscriber's side

The Subscriber bears the cost of what is needed to operate the platform on its side: a stable internet connection, devices capable of running the field scanning screen with their cameras, and supported modern browsers. The Company is not in breach of its obligations where operation fails for a reason arising from the Subscriber's technical environment.

4-1  Accuracy of establishment data

The Subscriber undertakes to provide accurate, up-to-date data about its establishment — legal name, commercial registration, address, contact channels and authorised representative — and to notify the Company in writing of any material change to it within fifteen days of that change.

4-2  Accuracy of published services

• That every service, price, time and capacity it publishes is accurate and not misleading.
• That it is duly licensed to carry on the activity whose services it publishes.
• That it publishes through the platform no service or content contrary to the law, to public decency, or to the rights of others.
• That it updates or unpublishes any service as soon as it in fact ceases to provide it.

4-3  Honouring bookings

The Subscriber undertakes to honour every booking confirmed through the platform and to perform it at its appointed time and on the announced terms, and to handle any cancellation, amendment or refund in accordance with the policy it announced to the end user at the time of booking. The Company's responsibility here is limited to providing the tool through which the booking was made.

4-4  Control of staff accounts

• To create a separate account with defined permissions for each staff member, and not to permit shared accounts or passwords.
• To disable a staff account as soon as the employment relationship ends or the person's duties change.
• To restrict use of the field scanning screen to staff authorised to work at the point of entry.
• To bear full responsibility for every action taken through its establishment's accounts.

4-5  Limits on the use of end-user data

The Subscriber is given access to the data of end users who have booked its services solely for the purpose of delivering those services and providing customer care. It is expressly prohibited from extracting, aggregating, selling or sharing that data with third parties, or using it in unauthorised marketing, consistent with the Personal Data Protection Law and Article Eleven of this contract.

4-6  Proper use

• Not to attempt unauthorised access to any part of the platform or to another subscriber's data.
• Not to use automated tools to scrape content, overload the systems or test their security without prior written permission.
• Not to resell the licence or make it available to another establishment under any description.
• Not to use the Company's trademarks beyond what this agreement permits or without written permission.

6-1  Intellectual property

The platform in all its components — source code, databases, designs, interfaces, trademarks, guides and training materials — remains the exclusive property of the Company. This contract transfers none of these rights, or any part of them, to the Subscriber.

6-2  Ownership of Subscriber data

The data the Subscriber enters about its establishment and its services remains its property. The Company processes it as a data processor, for the purpose of operating the platform and delivering the service only, and the Subscriber may request a copy of it in a machine-readable format when the contractual relationship ends, under Article Fifteen.

6-3  Non-circumvention

The Subscriber undertakes not to — whether itself or through another — imitate the platform, reverse-engineer it, extract its operating logic, or build a competing product on the basis of what it has seen by virtue of this contract.

6-4  Mutual marketing use

Each party may refer to the other as a client or a supplier in its introductory materials, unless one notifies the other in writing to the contrary.

7-1  The package and its value

The values above include VAT at 15%. The authoritative package and price are those published on the packages page at the time of subscription and recorded on the tax invoice issued to the Subscriber.

7-2  What the package includes

• An unlimited number of published services.
• An unlimited number of bookings during the subscription term.
• End-user reviews and their display on the service pages.
• Online payment for the end user.
• Promo codes and offers.
• The reservations module and the reports attached to it.

7-3  Free trial period

The Company offers a new establishment a free trial of seven (7) days on the Unlimited Package, with no financial obligation. Access ends when that period expires unless the Subscriber activates a paid subscription. The trial period is granted only once per establishment.

7-4  Price changes

The Company may amend the prices of future packages, provided the amendment does not apply to a subscription term already paid for and running. The Subscriber is notified of any amendment at least thirty days before its subscription renews.

7-5  Prepaid packages

The subscription value is paid in advance for the whole of the chosen term and becomes due to the Company as soon as the subscription is activated. The subscription value does not include payment gateway fees or bank transfer fees where these apply.

8-1  Means of payment

Payment is made electronically through a payment gateway licensed by the central bank, using bank cards or the digital payment methods offered on the subscription page. The Company does not retain full card details; these are handled by the payment gateway alone.

8-2  Review of the commercial registration before activation

The Subscriber acknowledges that completing payment does not itself create an account; rather, the request passes through the following stages:

1. The subscription value is captured, recorded, and evidenced.
2. The request is referred for administrative review to verify the commercial registration and the establishment's data.
3. On approval, the account is activated and the dashboard set up, and the Subscriber is notified of its sign-in details.
4. Where the request is rejected because the commercial registration is invalid or the establishment's data is inconsistent, the subscription value is refunded in full to the same means of payment.

8-3  Tax invoicing

The Company issues an electronic tax invoice for each subscription in accordance with the requirements of the Zakat, Tax and Customs Authority, made available to the Subscriber by the registered email address or from its dashboard.

8-4  Renewal

The subscription ends when its paid term expires. The Subscriber is notified in good time before expiry so that it may decide whether to renew. No amount is deducted automatically from the Subscriber's means of payment unless it has expressly enabled automatic renewal, which it may disable at any time before the renewal date.

8-5  Refunds

The subscription value is non-refundable once the account has been activated and use has begun, unless termination is due to a material breach by the Company under Article Fifteen, or to rejection of the request at the administrative review stage under clause 8-2.

8-6  End-user payments

Where the Subscriber has enabled online payment on its services, what end users pay for those services belongs to the Subscriber, and the Company's role in it is limited to providing the collection channel under a separate settlement arrangement. Such amounts are not commingled with the Subscriber's own subscription value under Article Seven.

9-1  Failure to pay

Where a due subscription is not paid on time, the Subscriber's access to the dashboard and the field scanning screen is suspended automatically until payment is made. Public service pages stop accepting new bookings for the duration of the suspension, while bookings already confirmed remain in force.

9-2  Misuse

The Company may suspend the account immediately and without prior notice where any of the following is established:

• Publishing fictitious services or misleading data about prices, times or capacity.
• Extracting end-user data or using it outside the authorised purpose.
• Attempting unauthorised access to the Company's systems or to another subscriber's data.
• Reselling the licence or making it available to another establishment.
• Using the platform in an activity contrary to the laws in force.

9-3  Graduated sanctions

Other than in the cases in clause 9-2, the Company sends the Subscriber a written notice granting it seven days to remedy the breach. If it is not remedied, the account may be suspended; and if the same breach recurs three times within twelve months, the contract may be terminated under Article Fifteen.

9-4  Effect of suspension on the fee

Suspension of the account does not stop the paid subscription term from running, and creates no right to a refund or an extension of it, where the suspension arises from a ground set out in this Article.

10-1  Availability level

The Company aims to keep the platform available for no less than 99% of monthly uptime, excluding scheduled maintenance windows notified to the Subscriber in advance, force majeure events, and outages attributable to infrastructure or telecommunications providers.

10-2  Fault handling

10-3  Limits of the warranty

The Company does not warrant that the platform is free of every software defect, nor its fitness for a particular purpose not agreed in writing. Its obligation is limited to exercising due care in fixing what is reported within the target times above.

11-1  Capacity of each party

In respect of end-user data connected to the Subscriber's services, the Subscriber is the data controller as regards the purposes it determines for processing that data to deliver its services, and the Company is a data processor acting on the Subscriber's instructions and within the limits of operating the platform, in accordance with the Personal Data Protection Law and its implementing regulations.

11-2  Backups

The Company takes periodic backups of the platform's databases, retains them encrypted within a geographic scope compliant with Saudi law, and periodically tests that they can be restored.

11-3  Reporting data incidents

Where a leak or unauthorised access affecting the Subscriber's data or that of its end users occurs, the Company notifies the Subscriber within seventy-two (72) hours of becoming aware of the incident, setting out its nature, its scope and the measures taken, and cooperates with the Subscriber in notifying the competent authorities as required by law.

11-4  Retention and destruction

The Company does not retain the Subscriber's data after the contractual relationship ends except for the period required by law or to settle outstanding amounts, after which it destroys or anonymises it in accordance with the adopted Privacy Policy.

11-5  Liability cap

Neither party's total contractual liability to the other — for any direct damage arising out of this contract — exceeds the subscription value actually paid during the twelve months preceding the event giving rise to the damage. Neither party is liable for indirect damage, loss of profit, or indirect commercial loss. This cap does not apply to wilful breach, fraud, or breach of the data protection obligations.

11-6  The Subscriber's liability to its end users

The Subscriber alone bears any claim brought by an end user in respect of a service the Subscriber provided or failed to provide, and undertakes to indemnify the Company for any damage or legal costs it incurs as a result.

13-1  Governing law

This contract is governed, in its interpretation and performance, by the laws of the Kingdom of Saudi Arabia, and in particular those referred to in clause 1-3.

13-2  Amicable settlement

The parties shall seek to settle any dispute amicably within thirty days from the date on which one notifies the other in writing of the matter in dispute.

13-3  Jurisdiction

If amicable settlement is not possible, exclusive jurisdiction lies with the competent courts in the city of Riyadh.

13-4  Evidential weight of electronic records

The parties agree that the platform's records and electronic entries — including sign-in, booking, scanning and payment records — constitute admissible evidence in any dispute between them, in accordance with the Electronic Transactions Law.

14-1  Access control

• Each user is granted the least permission sufficient to perform their task, and permissions are reviewed periodically.
• Sharing sign-in credentials between the Subscriber's staff is prohibited in all circumstances.
• Sign-in events and sensitive actions are recorded in logs that cannot be altered from the user interfaces.

14-2  Identity verification

Access to the platform and verification of the end user rely on a one-time code sent to the registered mobile number. The Subscriber undertakes never to ask a user to disclose that code, and to inform the Company as soon as it suspects an impersonation attempt.

14-3  Channel and storage protection

Data is carried between the browser and the platform over an encrypted channel, passwords are stored in a form that cannot be recovered, and full bank card details are not stored in the Company's systems.

14-4  Incident reporting

Each party undertakes to notify the other as soon as it discovers a security incident affecting the platform or the accounts connected to it, and to cooperate in containing it. Notice from the Subscriber is sent to care@vip.sa.

14-5  Prohibition of unauthorised testing

The Subscriber is prohibited from conducting penetration tests, vulnerability scans or load tests against the platform without prior written permission from the Company setting out the scope and timing of the test.

15-1  Termination by the Subscriber

The Subscriber may terminate this contract at any time by written notice to the Company, with termination taking effect at the end of the paid subscription term and with no right to a refund of what was paid for it, under clause 8-5.

15-2  Termination by the Company

The Company may terminate the contract on thirty days' written notice, or immediately in the following cases:

• Repetition of a breach of Article Nine after warning under clause 9-3.
• Expiry, cancellation or proven invalidity of the Subscriber's commercial registration.
• Use of the platform in an activity contrary to the law or harmful to end users.
• The Subscriber ceasing to use its account entirely for more than six consecutive months after its paid subscription has ended.

15-3  Material breach by the Company

If the platform is entirely unavailable for more than seven consecutive days for a reason attributable to the Company and outside the force majeure cases, the Subscriber may terminate the contract and recover the unused portion of its subscription value, calculated pro rata.

15-4  Effects of termination

1. Access by the Subscriber and its staff to the dashboard and the field scanning screen ceases.
2. Public service pages stop accepting new bookings, while the Subscriber remains bound to perform bookings confirmed before termination.
3. The Subscriber may, within thirty days of the termination date, request a copy of its data in a machine-readable format.
4. Outstanding financial amounts between the parties are settled within thirty days.
5. The provisions on confidentiality, intellectual property, data protection and the liability cap survive termination.

16-1  Force majeure

Neither party is liable for delay in performing its obligations or for non-performance where this is due to force majeure beyond its control, including widespread outages of infrastructure or telecommunications providers, governmental decisions, or natural disasters. The affected party undertakes to notify the other within five days of the event.

16-2  Confidentiality

Each party undertakes to preserve the confidentiality of the other party's information that it learns by virtue of this contract, and not to disclose it to third parties except with written permission or at the request of a competent authority. This obligation continues for five years after the contract ends.

16-3  Notices

Notices between the parties are sent to the email addresses recorded at the head of this contract, and take effect from the date of sending unless the transmission fails for a technical error. Each party undertakes to update its address as soon as it changes.

16-4  Assignment

Neither party may assign this contract or any right under it to a third party without the other party's prior written consent, save for transfer of the contract consequent upon a merger of one of the parties or the transfer of its activity to a successor entity.

16-5  Severability

If a competent authority rules a provision of this contract void or unenforceable, the remaining provisions continue in full force, and the void provision is replaced by a valid one as close as possible to the parties' intention.

16-6  Entire agreement

This contract with its appendices represents the entirety of what the parties agreed on its subject matter, and supersedes every prior agreement, correspondence or offer. No amendment to it is effective unless made in writing and accepted by both parties.

16-7  Digital acceptance

The Subscriber acknowledges that clicking the acceptance button upon completing its subscription, or using the platform after its account is activated, stands in place of its signature on this contract and produces all its legal effects.

16-8  Language of the contract

This contract was drawn up in Arabic, with an English translation provided for reference. In the event of a difference in interpretation, the Arabic text prevails.