This Service Agreement (the "Agreement") is concluded, on the opening of an account, between Nivorbit Teknoloji Limited Şirketi (Nivorbit Teknoloji Limited Sirketi), a limited liability company registered in Türkiye, Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale · MERSİS 0631151313600001 · Trade registry Çanakkale / 9575 · Tax office/no Çanakkale VD 6311513136 · Phone +90 533 399 64 86 ("Punchla"), which operates Punchla, and the commercial business that opens a business account (the "Business").

1. Subject and scope

The Agreement governs the Business's use of the Punchla platform, the mobile app, the wallet card and the NFC device on the counter (the "Service"). The Data Processing Agreement governs the processing of customer data and the Privacy Notice the information duty; both are an integral part of the Agreement.

2. The account and its users

2.1. The person opening the account represents that they are authorised to act for the Business.

2.2. The Business defines the admin, branch-manager and staff roles itself and is responsible for what those users do.

2.3. Sign-in credentials are the Business's responsibility; suspected unauthorised access is to be reported without delay to support@punchla.com.

3. Subscription, trial and fees

3.1. Plan contents and fees are published on the pricing page. Fees are shown exclusive of VAT for Saudi Arabia; VAT is added on the invoice.

3.2. Each owner receives, once, a 30-day free trial of the plan they choose (Starter or Pro) with no card asked; that plan's limits apply during the trial. If no plan is chosen by the end of it, the account moves to the no-plan state: no punches are taken at the counter and no campaigns are sent, while cards, customers and earned rewards are kept and the service carries on where it left off once a plan is chosen.

3.3. The trial is per person. Opening a second business, or deleting and opening an account again, does not create a new trial.

3.4. Monthly subscriptions renew each month and annual subscriptions each year. The unit price of an annual plan is fixed for the term.

3.5. For Businesses in every market except Türkiye, our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. Those purchases are also subject to Paddle's Buyer Terms, and Paddle's name appears on the card statement. In Türkiye Punchla is the seller and payment is taken on the secure page of iyzico, a licensed payment institution. In either case card details do not reach Punchla and are not stored by Punchla.

3.6. If a payment fails, the renewal is retried a few times; if it still fails, the account moves to the no-plan state. Once paid, the service opens the same day.

3.7. Price changes are notified at least 30 days in advance and apply only from the following term.

4. Punchla Tap

4.1. With the membership, each branch receives one Punchla Tap NFC device and counter stand as a free welcome gift. Punchla Tap is not sold: it has no price, it is not part of the subscription fee, and nothing is charged for it or for its shipping.

4.2. The Service works fully without the device: until it arrives, and whenever it cannot be used, the programme works the same way through the sign-up QR card.

4.3. A device that fails while the subscription runs is replaced free of charge; shipping is on Punchla.

4.4. The device never has to be sent back: not on cancellation, not for a refund and not when the Agreement ends.

5. Withdrawal and refund

A Business that ends its subscription within 30 days of the first payment is refunded that payment in full. After 30 days there is no mid-term refund; a monthly subscription can be cancelled at any time and ends at the end of the term. The Refund Policy sets out the details; where Paddle is the Merchant of Record, Paddle issues the refund. A consumer's statutory rights are unaffected.

6. The Business's obligations

6.1. The Business announces the terms of its loyalty programme clearly and honours its reward promises.

6.2. The Business is responsible for the content of notifications sent to its customers and for their compliance with commercial electronic message law (PDPL).

6.3. The Business uses customer data only for its own loyalty programme and may not sell data obtained through Punchla to third parties.

6.4. The Service may not be used for unlawful or misleading purposes or in a way that infringes the rights of others.

7. Service level and support

Punchla aims, with commercially reasonable effort, to provide the Service without interruption; planned maintenance is announced in advance. Support is provided at support@punchla.com and answered on business days.

8. Personal data

For customer data the Business is the data controller and Punchla the data processor; the terms are set out in the Data Processing Agreement. Data is hosted in Saudi Arabia (Riyadh).

9. Intellectual property

All intellectual and industrial property rights in the Service belong to Punchla. The Agreement grants a limited, non-exclusive and non-transferable right to use the Service for the term of the subscription.

10. Suspension and termination

10.1. Punchla may suspend an account where payment cannot be taken, where the Agreement is breached, or where use threatens the security of the Service. Where a breach can be remedied, 7 days are given first.

10.2. Either party may end the Agreement at the end of a term by notice. On termination the Business may export its data from the platform; data is deleted or anonymised after 30 days.

11. Limitation of liability

Punchla's total liability under the Agreement is limited to the subscription fees collected from the Business in the 12 months before the event giving rise to it. Punchla is not liable for loss of profit, loss of business or indirect loss. Liability that cannot be limited by law is unaffected.

12. Force majeure

Obligations are suspended for the duration of events outside the parties' control (natural disaster, epidemic, official restriction, infrastructure and electronic communication outages); if the impediment lasts more than 30 days, either party may terminate.

13. Assignment and notices

The Business may not assign the Agreement without Punchla's written consent. Notices are sent to the e-mail address on the account and are deemed served on the day they are sent; where a registered electronic mail address has been given, service-of-notice law is unaffected.

14. Changes

Changes to the Agreement are notified by e-mail at least 15 days before they take effect. A Business that continues to use the Service after the notice is deemed to accept them; a Business that does not may terminate at the end of the term.

15. Governing law and jurisdiction

The Agreement is governed by Turkish law. The Istanbul (Çağlayan) Courts and Execution Offices have jurisdiction.

16. Contact

Nivorbit Teknoloji Limited Şirketi (Nivorbit Teknoloji Limited Sirketi), a limited liability company registered in Türkiye, Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale · MERSİS 0631151313600001 · Trade registry Çanakkale / 9575 · Tax office/no Çanakkale VD 6311513136 · Phone +90 533 399 64 86

E-mail: support@punchla.com

Effective date: Sep 29, 2026

This Data Processing Agreement (the "DPA") governs the processing of the customer data of a loyalty programme between the Business (the data controller) and Nivorbit Teknoloji Limited Şirketi (Nivorbit Teknoloji Limited Sirketi), a limited liability company registered in Türkiye, Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale · MERSİS 0631151313600001 · Trade registry Çanakkale / 9575 · Tax office/no Çanakkale VD 6311513136 · Phone +90 533 399 64 86 (the data processor), and is an integral part of the Service Agreement.

1. Subject, duration, nature and purpose

Punchla processes customer telephone numbers and e-mail addresses, punches, rewards, visit times and branch records solely to run the loyalty programme and on the Business's instructions. Processing lasts for the term of the Service Agreement.

2. Acting on instructions

Punchla does not use the data for its own purposes, share it with other businesses or sell it. Where processing outside the instructions is required by law, the Business is informed beforehand unless that is prohibited.

3. Confidentiality

Punchla staff with access are bound by confidentiality, and access is granted only to the extent their work requires.

4. Security measures

Encryption in transit and at rest, role-based access, logging and audit trails, regular backups with restore tests, environment separation and least privilege (KVKK Art. 12).

5. Sub-processors

Hosting: Hetzner Online GmbH (Falkenstein, Germany). Wallet cards and notifications: Apple Inc., Google LLC. Payments: a licensed payment institution (iyzico in Türkiye); for businesses in every market except Türkiye, Paddle.com Market Limited (London, United Kingdom), our online reseller and Merchant of Record. E-mail: our provider. Changes to the list are notified at least 30 days in advance; a Business with reasonable grounds to object may terminate.

6. Transfers abroad

Transfers to sub-processors abroad are made under Article 9 of the KVKK, on the standard contract published by the Board and notified to it.

7. Data subject requests

Punchla provides the technical assistance needed to answer data subject requests and forwards without delay any request that reaches it directly.

8. Personal data breach

Punchla notifies the Business of a breach without delay and in any event within 48 hours of becoming aware of it, with what is known of its scope, its effects and the measures taken. Notifying the Board and the data subjects is the Business's duty as controller.

9. Audit

The Business may audit compliance once a year on reasonable notice; the audit may also be satisfied by sharing current security documentation and independent audit reports.

10. Return and deletion

On termination, data is exported at the Business's request and deleted or anonymised within 30 days; records that must be kept by law are unaffected.

11. Liability

Liability is subject to the limits in the Service Agreement. Loss caused by Punchla processing outside the instructions falls outside those limits.

Effective date: Sep 29, 2026