License Agreement

5. Venues/Event Organizers Obligations

5.1. Compliance with Laws

The licensed use of the application is contingent upon your adherence to all applicable laws and regulations. You agree not to utilize the software for any illegal purposes, including but not limited to activities that violate local, state, national, or international laws. Furthermore, compliance with the terms of this license is mandatory; any use of the application that contravenes these terms may result in the revocation of your license and potential legal action. It is your responsibility to ensure that your usage of the application aligns with these requirements to maintain the integrity and legality of your activities.

5.2. Contractual Agreement

This License Agreement and the accompanying Terms of Use constitute a binding contractual agreement between the parties. In the absence of a separate specific contract governing the relationship, these documents shall govern the terms of use and the rights and obligations of the parties involved.

5.3. Payment Services

When it comes to payment for our Services, you are required to remit payment on a monthly, quarterly, bi-annual, or annual basis, depending on the specific plan you have selected.

5.4. No-Shows, Cancellations & Refunds

If you do not have a cancellation policy in place, XO Entertainment Ltd requires that Application Users provide at least 30 minutes notice of the cancellation of an event booking (tickets or reservations) or a standard (day-to-day) reservation made through the Service, either by contacting you directly or through the Service. The final determination of a no-show will be made by you at your sole discretion.[MOU1] 

By being a partner of XO, you agree to the following terms in compliance with EU legislation. XO’s booking/service fees are non-refundable, except where legally required. These fees cover platform usage and remain non-refundable, even if a refund is issued for an event ticket, event reservation, standard venue reservation (day-to-day reservation), or digital menu order.

5.4.1. Event Booking Refunds

·       When the venue/event organizer/partner cancels or reschedules:

·      Event Cancellation: Users will be eligible for a refund of the amount paid online (e.g., tickets or reservation deposits). XO’s booking/service fees remain non-refundable, except where legally required.

·      Event Rescheduling: Users who cannot attend the new date/time will be eligible for a refund of the amount paid online (e.g., tickets or reservation deposits). XO’s booking/service fees remain non-refundable, except where legally required.

·      Change in Event Location: Users unable to attend the updated location will be eligible for a refund of the amount paid online (e.g., tickets or reservation deposits). XO’s booking/service fees remain non-refundable, except where legally required.

· When the user cancels:

· If a user cancels a ticket or event reservation more than 48 hours before the event start time, a refund of the amount paid online may be issued, subject to agreement with the venue/event organizer/partner.

· No refunds will be issued for cancellations made within 48 hours of the event start time, unless the venue/event organizer/partner agrees.

· XO’s booking/service fees remain non-refundable except where legally required.

5.4.2. Standard Venue Reservation (Day-to-Day Reservation) Refunds

·       When the venue/event organizer/partner cancels:

·      Users will be eligible for a refund of the amount paid online. XO’s booking/service fees remain non-refundable, except where legally required.

·       When the user cancels:

· If a user cancels a standard venue reservation (day-to-day reservation) more than 48 hours before the reservation time, a refund of the amount paid online may be issued, subject to agreement with the venue/event organizer/partner.

· No refunds will be issued for cancellations made within 48 hours of the reservation time, unless the venue/event organizer/partner agrees.

· XO’s booking/service fees remain non-refundable, except where legally required.

5.4.3. Promotional & Marketing Payments

·       All promotional payments made by venue/event organizers/partners are non-refundable.

·       This applies to payments made on a one-time, weekly, monthly, quarterly, bi-yearly, or yearly basis, regardless of campaign performance or schedule changes.

·       No refunds will be granted due to event cancellations, lower-than-expected marketing results, or changes in promotional strategy.

·       XO reserves the right to suspend or modify any marketing campaign if a partner violates platform policies. In such cases, no refund will be issued for any prepaid promotional fees.

·       Partners acknowledge that advertising and promotional placements through XO are at their discretion, and XO does not guarantee specific performance outcomes, ticket/reservation sales, or increased engagement from paid marketing efforts.

·       Any requests for modifications to a live campaign must be submitted in writing and will be assessed based on feasibility, but do not qualify for refunds or credit adjustments.

If you have a separate cancellation policy and you have required from Application Users to provide a credit card to confirm their reservation, then you are obliged to provide this policy to XO Entertainment Ltd so we can forward this policy to the Application Users on your behalf. XO Entertainment Ltd will request the Application Users payment information and by submitting such information through the Service, XO Entertainment Ltd will have the authorization to share this payment information with a third-party processor to process the payments accordingly. We do not directly collect or process any financial data. For more information regarding XO Entertainment Ltd use of payment providers, see our Privacy Policy. XO Entertainment Ltd is not responsible for errors made or fees charged by the processors or financial institutions.

Please note that you may require Application Users to provide payment information in conjunction with the Service, including (i) prepayment of bills, (ii) cancellation fees, or (iii) payment card which is necessary to make a booking.

5.6. Third Party Content

The Services may contain links to third-party websites (“Third Party Websites”) and applications (“Third Party Applications” and, collectively with Third Party Websites, “Third Party Content”).  When you click on a link to Third Party Content, we will not warn you that you have left the Services and are subject to the terms and conditions (including privacy policies) of another website or destination. Such Third-Party Content and sites are not under the control of XO Entertainment Ltd, and XO Entertainment Ltd is not responsible for such content or sites. XO Entertainment Ltd provides Third Party Content only as a convenience and does not review, approve, monitor, endorse, warrant, or make any representations with respect to Third Party Content.  You use all Third-Party Content at your own risk. You should review applicable terms and policies, including privacy and data gathering practices, of any Third-Party Websites or Third-Party Applications, and should make whatever investigation you feel necessary or appropriate before proceeding with any transaction with any third party.

5.7. Transfer of Your Rights

You may only transfer your rights or your obligations under these terms to another person if we agree in writing.

5.8. No Rights for Third Parties

This agreement is binding solely between the parties and does not confer any rights or benefits on any third party, nor shall any third party have any rights to enforce any term of this agreement under the principles of privity of contract or any other legal doctrine.

5.9. Data Processing & Compliance

XO acts as the Data Controller, and by subcontracting certain Services, this implies the processing of personal data, to the Data Processor/Processor (venues, event organizers, and/or partners). This is in accordance with GDPR (Regulation (EU) 2016/679) and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Partners must comply with all obligations imposed on Data Processors under GDPR.

The personal data collected and processed may include, but is not limited to:

• Identity data: Name, email address, phone number, and date of birth.

• Transactional data: Payment details, booking history, and preferences.

• Event-related data: Tickets purchased, table bookings, reservations, and attendance details

If XO provides access to customer data via an export feature, the event organizer, venue, or any other partner/associate agrees to:

• Use the exported data strictly for event and venue management purposes provided through XO’s platform.

• Prohibit the use of exported data for unrelated business activities, such as marketing for venues, events, or services that are not part of XO.

• Comply with GDPR and all applicable data protection laws when processing exported customer data.

• Obtain separate explicit consent from customers before using their data for marketing purposes.

• Acknowledge that XO is the data controller, and the exporting party assumes the role of a data processor, responsible for handling the data lawfully.

Event organizers, venues and/or partners/associates may only use customer data for operational purposes related to XO services (e.g., event check-ins, order processing, customer support). Event organizers, venues, and partners/associates of XO must obtain separate explicit consent before sending you marketing messages. You may withdraw consent at any time by clicking "unsubscribe" in marketing emails or by contacting us at contact@thexo.app. XO is not responsible for any misuse of exported customer data for unauthorized marketing. XO reserves the right to restrict or revoke data export access if the venue, event organizer, or any other partner/associate fails to comply with these obligations. XO acts as the Data Controller and grants venues, event organizers, and any other partners/associates limited access to customer data for event management, reservations, and order processing within XO’s platform. If customer data is exported, the venue, event organizer, and/or associate/partner becomes a Data Processor, assuming full responsibility for compliance with GDPR and other applicable laws.

• Data may only be used for services provided through XO (e.g., event operations, venue management, reservations, and customer engagement within XO).

• The exported data cannot be used for external marketing or business activities outside XO.

• The exporting party is responsible for ensuring that any marketing communication based on exported data is conducted only with explicit customer consent.

Failure to comply with these obligations may result in termination of access to XO’s data services and possible legal consequences for GDPR violations.

5.9.1. Data Scope & Processing

The Processor acknowledges that XO processes the following categories of personal data:

• Identity Data (such as name, email address, phone number, date of birth).

• Transactional Data (such as payment details, booking history, preferences).

• Event & Venue Data (such as tickets purchased, event table bookings/reservations, standard/day-to-day reservations, attendance records).

5.9.2. Processor Obligations

• The Processor must process personal data only as necessary to fulfill services through the XO platform.

• The Processor must not store, analyze, or reuse user data for external marketing, profiling, or analytics without explicit consent.

• The Processor must maintain confidentiality and ensure any employees and subcontractors comply with GDPR standards, and are bound by confidentiality agreements.

• Access to personal data must be strictly necessary for the services provided, and employees or subcontractors must receive ongoing training on GDPR compliance.

• Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall in relation to the Company Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

• In assessing the appropriate level of security, the Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

5.9.3. Security & Breach Reporting

• The Processor must implement technical and organizational security measures to prevent unauthorized access or misuse of user data.

• The Processor shall notify the Company without undue delay upon the Processor becoming aware of a Personal Data Breach affecting Company Personal Data, providing the Company with sufficient information to allow the Company to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

• The Processor shall co-operate with the Company and take reasonable commercial steps as directed by the Company to assist in the investigation, mitigation, and remediation of each such Personal Data Breach as well as for reporting to the authorities’ purposes.

5.9.4. Subprocessing Restrictions

• Before engaging a new Subprocessor, the Processor shall notify the Company and/or the controller in writing, with:

• The name and address of the Subprocessor;

• The specific processing activities the Subprocessor will undertake; and

• The safeguards and measures the Subprocessor will implement to ensure compliance with the GDPR and any other data protection laws and regulations.

• The Processor will maintain an up-to-date list of subprocessors engaged for data processing activities. This list will be available upon request and updated 30 days prior to the addition of any new subprocessor. The Company and/or Controller reserves the right to object to any subprocessor on reasonable grounds within this notice period as explained below.

Company’s/ Controller’s Right to Object

• The Company and/or Controller shall have the right to object to the appointment of any new Subprocessor on reasonable grounds relating to the protection of Personal Data.

• Any objection must be raised by within 30 days of receiving notification of the intended engagement of the Subprocessor.

• If the Company and/or the Controller objects to the appointment of the Subprocessor, the Processor shall:

• Make reasonable efforts to address these concerns, including proposing an alternative Subprocessor or adopting additional safeguards; or

• Allow the Company and/or the Controller to terminate the processing services that involve the proposed Subprocessor without penalty, subject to mutual agreement on reasonable notice.

5.9.5. Data Transfer

• The Processor may not transfer or authorize the transfer of Data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of the Company. If personal data processed under this Agreement is transferred from a country within the European Economic Area to a country outside the European Economic Area, the Parties shall ensure that the personal data are adequately protected. To achieve this, the Parties shall, unless agreed otherwise, rely on EU approved Standard Contractual Clauses for the transfer of personal data.

• This Agreement incorporates the Standard Contractual Clauses approved by the European Commission for cross-border transfers of personal data outside the EEA. These Clauses as attached in Annex 2, form an integral part of this Agreement.

5.9.6. Audit & Compliance

• The Processor shall make available to the Company on request all information necessary to demonstrate compliance with this License Agreement, and shall allow for and contribute to audits, including inspections, by the Company or an auditor mandated by the Company in relation to the Processing of the Company Personal Data by the Contracted Processors.

• Information and audit rights of the Company only arise to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.

• Audits may be conducted no more than once per calendar year, with at least 30 days’ written notice to the Processor. The Company and/or the Controller will bear all costs associated with such audits unless a material breach of this Agreement is identified, in which case costs may be borne by the Processor.

5.9.7. Data Protection Impact Assessment & Prior Consultation

• The Processor shall provide reasonable assistance to the Company with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which the Company reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking into account the nature of the Processing and information available to, the Contracted Processors.

• The Processor will provide reasonable assistance to the Company and/or the Controller for the completion of any required Data Protection Impact Assessments (DPIAs), including providing information about data processing activities, measures to mitigate risks, and security controls.

5.9.8. Data Subject Rights & Assistance

Taking into account the nature of the Processing, the Processor shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

The Processor shall:

• Promptly notify the Company if it receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and

• Ensure that it does not respond to that request except on the documented instructions of Company or as required by Applicable Laws to which the Processor is subject, in which case the Processor shall to the extent permitted by Applicable Laws inform the Company of that legal requirement before the Contracted Processor responds to the request.

5.9.9. Confidentiality Obligations

• The Processor must ensure all personnel handling personal data are bound by confidentiality agreements.

• Access to personal data must be restricted to employees or subcontractors of the Processor strictly necessary for providing the agreed services.

• Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement confidential and must not use or disclose that confidential information without the prior written consent of the other Party except to the extent that:

o Disclosure is required by law;

o The relevant information is already in the public domain.

5.9.10. Liability for GDPR Violations

• The Processor will be liable for any GDPR breaches resulting from non-compliance.

• If the Processor’s actions lead to regulatory fines or lawsuits, the Processor agrees to fully indemnify and hold XO harmless for damages.

5.9.11 Deletion and Return of Company Personal Data

• Upon termination of License, the Processor will return and/or securely delete all personal data collected and processed to date within 30 days, unless further storage is required by law. Written confirmation of deletion must be provided as applicable.

5.10. Tax and VAT Compliance

The Venue, Event Organizer and/or any other partner acknowledges that XO operates solely as an intermediary and is not the principal in any transaction made through the XO platform. It is the responsibility of the Venue, Event Organizer and/or any other partner to determine, apply, and remit all applicable VAT, sales tax, or similar levies in accordance with their local jurisdiction. XO shall not be held liable for any failure by the Venue, Event Organizer and/or any other partner to comply with their tax obligations. The Venue, Event Organizer and/or any other partner agrees to indemnify XO against any claims, penalties, or liabilities resulting from non-compliance with applicable tax laws.