AIDA Master Subscription Agreement

Document id subscription-agreement, version 1.0. Effective date: the date stated in the Legal Center on publication. This AIDA Master Subscription Agreement (the "MSA") is entered into by signing or accepting an Order Form that incorporates it (clause 3.1). Current and past versions: https://www.myaidateam.com/legal/subscription-agreement.

1. Parties

1.1 PalmDine AI - FZCO, a free zone company registered with the International Free Zone Authority (IFZA), Dubai, United Arab Emirates, licence number 62637, doing business as "AIDA", of DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates, VAT TRN 105015185900001 ("PalmDine").

1.2 The customer named in the Order Form ("Customer").

1.3 Each is a "party". Together they are the "parties".

2. Definitions

In this agreement:

2.1 Agreement means this MSA, every Order Form, the data processing addendum (the DPA) and its Annexes A and B, and any country rider in Annex C that an Order Form selects, each in the version the Order Form names.

2.2 AI Output means any text, speech, video, summary, suggestion, classification or other content that an AI feature of the Services generates.

2.3 Authorised User means an owner, manager or staff member the Customer allows to use the console, the till or any other staff surface.

2.4 Configuration means the settings the Customer chooses for each Venue in the console, including the settings listed in clause 6.2.

2.5 Customer Data means all data the Customer, its Authorised Users or its Guests put into the Services, or that the Services create for the Customer while processing that data. It includes Customer Personal Data.

2.6 Customer Personal Data means personal data within Customer Data that PalmDine processes for the Customer as processor, as described in the DPA.

2.7 DPA means the AIDA Data Processing Addendum, document id dpa, with its Annexes A (details of the processing), B (subprocessors) and, where selected, C (country riders) and D (group sharing arrangement).

2.8 Fees means the amounts stated in the Order Form.

2.9 Guest means a person who books, visits, orders from, pays, messages or calls a Venue through the Services.

2.10 Legal Center means the AIDA Legal Center at https://www.myaidateam.com/legal, where PalmDine publishes the current and past versions of the documents that make up this Agreement.

2.11 Modules means the parts of the Services listed in clause 3.4.

2.12 Order Form means a document in the form of the AIDA Standard Order Form, signed or accepted by both parties, that refers to this agreement and records the matters in clause 3.2.

2.13 Services means the AIDA platform and the Modules the Order Form lists, with the support described in clause 4.

2.14 Subscription Term means the period stated in the Order Form.

2.15 Venue means a restaurant or other outlet the Order Form lists.

2.16 Business Day means a day other than a Saturday, Sunday or public holiday in Dubai, United Arab Emirates.

3. Order forms

3.1 Each Order Form is governed by this agreement and incorporates it by reference, in the version the Order Form names. If documents conflict, clause 24.2 decides which prevails.

3.2 An Order Form records the following. The section numbers are those of the Standard Order Form. Its header states the Order Form reference, its date and the date until which it may be accepted; PalmDine may withdraw or reissue an Order Form the Customer has not accepted by that date.

3.3 Where an Order Form leaves a matter in clause 3.2 blank, the default in this agreement applies if one is specified (for example the support hours in clause 4.2). If there is no default, the parties shall complete the matter in writing; the rest of the Order Form is unaffected.

3.4 The Modules are:

3.5 The Order Form states, for each Venue, which Host channels are enabled. The subprocessors that apply follow from those choices (Annex B Part A).

3.6 A product description, sales material or roadmap does not add to the Services unless the Order Form says so.

4. Services and support

4.1 PalmDine will provide the Services for each Venue during the Subscription Term, in line with this Agreement.

4.2 Support and service levels. PalmDine provides support by e-mail to support@palmdine.ai and by any other channel the Order Form names. PalmDine gives no uptime percentage and no service credits; its service commitment is the response targets below, measured from the time the Customer reports the issue on a support channel:

PalmDine keeps the Customer informed until a Severity 1 or 2 issue is resolved or a workaround is in place. Response targets are targets, not guarantees; missing one is not a material breach unless it is repeated and unremedied after notice under clause 12.6. An Order Form may set shorter targets or longer hours for a Venue.

4.3 Business continuity. AIDA assists the Customer's service; it does not replace the Customer's own ability to run it. The Customer keeps the ordinary means of operating each Venue when the Services are unavailable: its own published reservation number answered by staff, staff who take orders and payments in person, and printed menus. PalmDine designs the Services so that these fallbacks remain available at all times (a Venue's phone number continues to ring to the Venue when the Host is unavailable, and the till and Waiter app degrade to manual operation) and documents them for staff.

4.4 PalmDine may change the Services, for example to improve them, fix faults, keep them secure or follow the law. PalmDine will not make a change that materially reduces the core function of a Module the Customer has paid for during the paid period. Where a change needs a new Configuration choice by the Customer, PalmDine will give notice before it takes effect.

4.5 Some features depend on third-party services that the Customer chooses to connect, such as a reservation system, a point-of-sale system or a delivery platform (Annex B Part B). PalmDine is not responsible for those services or for their availability.

4.6 Where the Customer uses the POS Module on an edge device, the device stores the Venue's operational records locally and synchronises them with the cloud. The Customer is responsible for the physical security of the device, its power and its network. The Order Form (section 12) lists each edge device used for the POS Module and, for each device, one of the three supply models below:

(a) Purchased device. PalmDine sells the device to the Customer for the hardware Fee in the Order Form. Title passes to the Customer on payment in full; risk of loss or damage passes on delivery to the Venue. PalmDine passes through the manufacturer's warranty (12 months from delivery unless the Order Form says otherwise) and, during that period, repairs or replaces a device that fails through no fault of the Customer. The device is not returned at the end of the Subscription Term. The software on it remains licensed under clause 16.3.

(b) Loaned device. PalmDine supplies the device for use with the Services for the Subscription Term, for the hardware Fee in the Order Form (which may be nil). PalmDine keeps title. The Customer bears the risk of loss, theft or damage while the device is at the Venue, fair wear and tear excepted, and pays the replacement value stated in the Order Form for a device that is lost or damaged beyond fair wear. PalmDine replaces a device that fails through no fault of the Customer at no charge. Within 30 days after the Order Form ends the Customer returns the device to the address PalmDine names, at PalmDine's cost for the carriage, or pays the replacement value. Before return, the Venue's records are wiped from the device (DPA clause 12.3(d)).

(c) Customer's own device. The Customer runs the POS Module on hardware it owns that meets the specification PalmDine publishes for edge devices. PalmDine gives no warranty for the hardware and is not responsible for a fault caused by hardware outside the specification. The software on it remains licensed under clause 16.3.

Under every model the Customer is responsible for the physical security of the device, its power and its network, and for wiping or returning it at the end of the Subscription Term as the model requires.

5. PalmDine responsibilities

PalmDine will:

5.1 provide the Services with reasonable skill and care;

5.2 keep in place the security measures described in the DPA and Annex A §7, and not materially reduce them during the Subscription Term;

5.3 process Customer Personal Data only as the DPA allows;

5.4 ship each Configuration setting in clause 6.2 with a default designed to comply with the laws that commonly apply to restaurants, and provide the technical means to show notices and record consent, as the published Terms & Conditions already state (Terms clause 28);

5.5 not use Customer Data for advertising, and not use identifiable Customer Personal Data to train AI models, for PalmDine's own purposes;

5.6 keep the Legal Center up to date with the current version of each document in this Agreement and every previous version (clause 13); and

5.7 comply with the laws that apply to PalmDine as the provider of the Services.

6. Customer responsibilities

6.1 General. The Customer will:

(a) use the Services only for its Venues and in line with this Agreement and the law;

(b) keep its venue details accurate, including its legal name, address, contact details, opening hours, prices, taxes, menu, allergen information, deposit and cancellation rules;

(c) make sure each Authorised User has only the access they need, keeps their sign-in details confidential and uses the Services properly. The Customer is responsible for what its Authorised Users do in the Services;

(d) have a lawful basis, and any notice or consent the law requires, for its own processing of Guest and staff personal data; and

(e) tell PalmDine promptly if it suspects unauthorised use of its account.

6.2 Configuration duties. AIDA gives each Venue settings that control how Guests are informed and asked for permission. The Customer is responsible for choosing settings that are lawful where the Venue operates, and must not turn off or work around a notice or consent step that the law in its location requires (Terms clause 28). In particular:

6.3 Evidence of Configuration. PalmDine may keep a record of the Customer's Configuration and of changes to it, and may use it to show what the Customer chose. Console setting changes are written to an audit trail.

6.4 Customer's own systems. Where the Customer connects a third-party system, the Customer is responsible for its contract with that provider and for the lawfulness of sending data to it (Annex B Part B).

7. Acceptable use

7.1 The Customer must not, and must not let anyone else:

(a) use the Services to break the law or anyone's rights, including privacy, consumer, telecoms and anti-spam law;

(b) use the Services to send unsolicited marketing;

(c) try to reach another customer's data, test the Services' security without PalmDine's written permission, or get around a technical limit;

(d) copy, resell, sublicense or reverse engineer the Services, except where the law allows it and cannot be excluded;

(e) upload malware or content that is unlawful, infringing, or harmful to Guests or staff;

(f) use AI Output to make a decision that has a legal or similarly significant effect on a person without human review (clause 9.3);

(g) use the Services to infer a person's sensitive characteristics, such as health (beyond allergy and dietary needs the person states), religion, ethnicity or sexual life. The Services store only demographic facts a Guest states; or

(h) use the Services in a way that puts unreasonable load on them.

7.2 PalmDine may remove content, or suspend a feature, that breaks clause 7.1 (clause 14).

8. Data and content

8.1 Customer Data. As between the parties, the Customer owns Customer Data. The Customer gives PalmDine a non-exclusive, worldwide, royalty-free right to host, copy, process and display Customer Data only to provide, secure and support the Services, to meet PalmDine's legal duties and as the DPA allows.

8.2 Personal data. The DPA governs Customer Personal Data. If this agreement and the DPA conflict on a point about personal data, the DPA prevails.

8.3 PalmDine's own data. PalmDine is an independent controller of the personal data it processes for its own purposes: platform accounts, security and audit logs, billing and account management, business contact with the Customer's representatives, and a Guest's platform account where the Guest links it to Venues (DPA clause 2.3). The AIDA Privacy Policy describes that processing.

8.4 Service data and statistics. PalmDine may collect technical and usage data about the Services, such as performance, errors and AI usage cost per Venue, and may use it to run, secure, bill for and improve the Services. PalmDine may also create and use aggregated, de-identified statistics derived from Customer Data across its customers (for example average no-show rates by city), on three conditions: no Customer, Venue, Guest or member of staff is identifiable from them or can be re-identified with reasonable effort; no Guest personal data is used to train AI models (DPA clause 3.5(b)); and the statistics are never sold or licensed as data. PalmDine will not disclose service data to third parties in a form that identifies the Customer or any person.

8.5 Feedback. PalmDine may use any feedback the Customer gives about the Services without restriction.

9. AI Output

9.1 The Services use AI models (Google Gemini, Annex B) to answer Guests, take bookings and orders, and help staff. AI Output can be wrong, incomplete or out of date.

9.2 PalmDine does not warrant that AI Output is accurate, complete or suitable for any purpose. This includes AI Output about prices, availability, allergens, dietary suitability, opening hours, directions, reports and staff matters.

9.3 Human review. The Customer must review AI Output before relying on it for a material decision, and must provide human review and a route to a person for any decision with a material effect on a Guest or a member of staff. The Services do not refuse a booking on the basis of an automated no-show score: the reliability score is shown to staff only, is never stored, and the AI host is bound by the rule that a Guest's past record never decides their booking.

9.4 The Customer is responsible for the menu, knowledge and instructions it gives the AI, and for correcting them when the AI repeats an error that comes from them.

9.5 Guests are told they are interacting with an AI assistant, and may ask for a person (Terms clause 29; clause 6.2(b)–(c)).

10. Fees and payment

10.1 The Customer will pay the Fees in the currency the Order Form states.

10.2 PalmDine invoices through Stripe, or by bank transfer where the Order Form says so (Terms clause 5). Subscription billing runs through Stripe; card data is entered on Stripe's own pages and never reaches PalmDine's systems.

10.3 Payment terms. Each invoice is payable by the due date the Order Form states. The Customer may dispute an invoice in writing, with reasons, within 14 days of the invoice date and pays the undisputed part on time; the parties resolve the disputed part in good faith within 30 days. PalmDine charges no late-payment interest; unpaid undisputed Fees are handled through suspension and termination under clauses 14.1(a) and 14.5.

10.4 Fees exclude VAT and other taxes. UAE VAT is charged at the applicable rate on Fees to Customers established in the UAE. For Customers established outside the UAE, the supply is treated as an export of services and the Customer accounts for any VAT or equivalent tax due in its own country under applicable reverse-charge or self-assessment rules. The Customer shall pay and bear any other sales, use, withholding, stamp, digital service or similar tax that applies, except taxes based on PalmDine's net income. PalmDine's UAE TRN is 105015185900001; a Customer established outside the UAE states its own tax identification number in the Order Form. If the law requires the Customer to withhold tax, the Customer will gross up the payment so PalmDine receives the full Fee, unless the Order Form says otherwise. Turkish stamp tax on an Order Form is borne by the Customer in full (Annex C §1.9). Qatar withholding tax (5% on the gross Fee) is grossed up by the Customer (Annex C §3.7).

10.5 Fee changes. Fees are fixed for each Subscription Term. PalmDine may change the Fees for a renewal term only by notice to the Customer at least 60 days before the renewal date, and the changed Fees apply only under a new Order Form that the Customer signs or accepts. If the Customer has not signed or accepted the new Order Form by the renewal date, the subscription does not renew and ends at the end of the then-current Subscription Term. To the extent the published AIDA Terms allow prices to change at any time, this clause and the Order Form prevail for the Customer (clause 24.2).

10.6 Guest payments and PalmDine's billing. Guest payments to the Customer are separate from the Fees. They run through the Customer's own connected payment account (Stripe Connect, or Square), under the Customer's own agreement with that provider; PalmDine's platform integration initiates charges and refunds on the Customer's instructions as its processor. PalmDine collects the Fees from the Customer through its own Stripe account, by invoices PalmDine issues from the Stripe dashboard; that billing is PalmDine's own processing (DPA clause 2.3(c)) and is not part of the Services. Taking guest payments through the Services is optional: a Customer may take payment outside the Services with any provider it chooses, and no guest payment data then passes through PalmDine.

11. AI usage package

11.1 The Order Form describes the AI usage package: what AI usage is included for each Venue, how usage is measured, and what happens when the included usage is used up. A Venue's Guests continue to be served when its included usage is used up.

11.2 Where the Order Form provides for an overage fee or an upgrade, it applies from the point the included usage is used up; where it provides for a notice only, PalmDine notifies the account owner and no additional Fee is due.

12. Term, renewal and termination

12.1 Term. This agreement starts on the date the first Order Form is signed or accepted, and continues while any Order Form is in force.

12.2 Automatic renewal. At the end of each Subscription Term the subscription renews automatically for a further period of the same length, or of the renewal period the Order Form states, unless either party gives the other notice of non-renewal at least 30 days before the end of the then-current Subscription Term. The Fees for a renewal term are the Fees of the expiring term unless changed under clause 10.5, and are invoiced and collected as the Order Form provides (clause 10.2). This matches the published Terms (clauses 6 and 30).

12.3 Negotiated term. The length of each Subscription Term is agreed in the Order Form.

12.4 Trial. Any trial period, and what happens at its end, is agreed in the Order Form. A trial does not become a paid subscription unless the Customer signs or accepts a paid Order Form.

12.5 Customer cancellation. The Customer may cancel a subscription at any time, without penalty, by giving PalmDine customer service at least 30 days' notice. The subscription ends at the end of the billing period in which the notice period expires. Fees for billing periods up to that date remain payable, and Fees already paid are not refunded, unless the Order Form or applicable law says otherwise. No Fees fall due for any later period. No Order Form may set a minimum commitment, an early-cancellation fee or any other charge for cancelling. A loaned edge device is returned under clause 4.6(b).

12.6 Termination for breach. Either party may terminate an Order Form by written notice if the other party materially breaches this Agreement and does not fix the breach within 30 days after notice. If the Customer terminates for PalmDine's uncured material breach, PalmDine will refund prepaid subscription Fees for the period after termination within 30 days, to the original payment method. Set-up, onboarding and hardware Fees are not refunded.

12.7 Insolvency. Either party may terminate if the other becomes insolvent, enters liquidation or a similar process, or stops trading, to the extent the law allows.

12.8 PalmDine termination. PalmDine may terminate an Order Form by 90 days' notice if it stops offering a Module generally, and will refund prepaid subscription Fees for the period after termination within 30 days, to the original payment method. Set-up, onboarding and hardware Fees are not refunded.

12.9 Effect of termination. When an Order Form ends:

(a) the Customer's right to use the affected Services ends;

(b) the Customer pays all Fees due up to the end date;

(c) Customer Data is returned and deleted as set out in DPA clause 12; and

(d) clauses 8, 9, 10 (for unpaid Fees), 12.9, 15, 16, 18, 19 and 21–25 survive.

13. Changes to this agreement

13.1 PalmDine may update this MSA, the DPA or its annexes by publishing a new version in the Legal Center and giving the Customer at least 30 days' notice by email and in the console before the change takes effect. This matches the 30-day notice in the published Terms.

13.2 Changes needed for security, a new feature the Customer chooses to use, a court order or a change in law may take effect sooner, with as much notice as is reasonable.

13.3 Material changes. If a change to this MSA materially reduces the Customer's rights or PalmDine's obligations, the Customer may reject it by notice before it takes effect; the current version then continues to apply until the end of the current paid period, after which either party may end the subscription. Otherwise, continued use of the Services after the effective date is acceptance of the change. A change to the DPA or its annexes that reduces the protection of Customer Personal Data takes effect for the Customer only when the Customer accepts it in the console or by signed document; until then the previous DPA continues to apply, and if the Customer has not accepted by the end of the current paid period either party may end the subscription. A DPA change that adds protection takes effect on notice.

13.4 A change to a signed Order Form needs both parties' agreement.

13.5 Re-acceptance is recorded in the Legal Center, by console acceptance or signed document, in the same way as the original acceptance (clause 24.4).

13.6 Changes to the list of subprocessors follow DPA clause 6, not this clause.

13.7 Publication. This MSA, the DPA and its annexes, the country riders and Annex D are published in the Legal Center for anyone to read; Order Forms and any negotiated terms are private to the parties.

14. Suspension

14.1 Grounds. PalmDine may suspend a Venue, a feature or an Authorised User's access, in whole or in part, if:

(a) the Customer does not pay undisputed Fees within 14 days after a written reminder;

(b) PalmDine reasonably believes a Configuration, or the Customer's use, breaks the law or clause 7, as the published Terms already allow (Terms clause 28);

(c) suspension is needed to prevent a security incident or harm to Guests, other customers or the Services; or

(d) the law or an authority requires it.

14.2 Notice. For grounds (a) and (b) PalmDine gives at least five (5) Business Days' written notice naming the ground and what would end it, and suspends only if the ground still stands at the end of that period. For grounds (c) and (d) PalmDine may suspend without prior notice and will notify the Customer as soon as reasonably possible afterwards.

14.3 Staged suspension. For non-payment under ground (a), PalmDine first suspends features that do not stop service on the floor (reports and insights, add-on Modules) and suspends bookings, the AI host and the till only if the Fees remain unpaid ten (10) Business Days after that first suspension. For every ground, PalmDine limits the suspension to what is needed and restores access within one (1) Business Day after the reason has gone.

14.4 Fees during suspension. Fees continue to accrue during a suspension. Where a suspension caused by ground (c) or (d) lasts more than thirty (30) days without fault of the Customer, Fees for the suspended Venue or feature stop accruing from the thirty-first day until access is restored. No Fees are due for a period in which PalmDine suspended in error.

14.5 Termination after suspension. If a suspension for non-payment under ground (a) has lasted thirty (30) days, PalmDine may terminate the affected Order Form by written notice without a further cure period. Clause 12.9 (effect of termination) applies.

15. Confidentiality

15.1 Each party will keep the other's confidential information secret, use it only for this Agreement, and share it only with its staff, advisers and subcontractors who need it and are bound by similar duties.

15.2 Confidential information does not include information that is public without fault of the receiving party, was already known to it, is received lawfully from a third party, or is developed independently.

15.3 A party may disclose confidential information where the law or an authority requires it, after telling the other party where the law allows.

15.4 These duties last for the Subscription Term and five years after it. They last indefinitely for trade secrets and personal data.

15.5 The DPA's confidentiality terms apply to Customer Personal Data in addition to this clause.

16. Intellectual property

16.1 PalmDine and its licensors own the Services, the software, the AI configuration, the documentation and all improvements to them. Nothing in this Agreement transfers them.

16.2 PalmDine grants the Customer a non-exclusive, non-transferable right to use the Services for its Venues during the Subscription Term.

16.3 Software installed on an edge device or delivered as an app is licensed, not sold, and only for use with the Services.

16.4 The Customer owns its trademarks, menu content and photographs. It gives PalmDine the right to use them to provide the Services and, unless the Customer objects, to name the Customer as a customer of AIDA, with its name and logo, in PalmDine's customer lists and marketing materials. The Customer may object at any time by notice to PalmDine; PalmDine then makes no new use and removes the Customer's name and logo from its website and current materials within 30 days.

16.5 AI Output. As between the parties, the Customer owns the AI Output created for it and may use it in its business, subject to clause 9 and to the AI provider's terms that PalmDine must pass on. PalmDine claims no rights in AI Output beyond what it needs to provide the Services and clause 8.4.

17. Warranties

17.1 Each party warrants that it has the power to enter into this Agreement and that its signer is authorised.

17.2 PalmDine warrants that the Services will perform materially as described in the documentation for the relevant Module. If they do not, the Customer must tell PalmDine, and PalmDine will fix the fault or, if it cannot, the Customer may terminate the affected Module and receive a refund of prepaid Fees for the period after termination. This is the Customer's only remedy for breach of this warranty.

17.3 The Customer warrants that it has the rights, notices and consents needed for the Customer Data it provides and for its Configuration.

17.4 Exclusions. To the extent the law allows, PalmDine does not warrant that: (a) the Services will be uninterrupted, error-free or free of harmful components; (b) AI Output will be accurate, complete, current or suitable for any decision, and the Customer remains responsible for checking AI Output before relying on it; (c) the Services will meet the Customer's particular requirements or purposes beyond the Documentation; (d) the Services will work with the Customer's own systems, connections or devices other than those the Documentation names; (e) the Services will achieve any particular result, such as bookings, covers, revenue or reduced no-shows; or (f) third-party services the Customer connects, such as payment, reservation, till or messaging providers, will be available or behave in any particular way. No other warranty, express or implied, applies except those stated in clauses 17.1 and 17.2.

18. Limitation of liability

18.1 Cap. Each party's total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the Fees paid and payable by the Customer under the Agreement in the six (6) months before the event giving rise to the claim. This matches the published Terms (clause 22).

18.2 Excluded losses. Neither party is liable, in contract, tort (including negligence) or otherwise, for loss of profit, revenue, business, goodwill or anticipated savings, loss or corruption of data other than as the DPA provides, or for any indirect or consequential loss, however arising and even if advised of its possibility. Each party expressly waives any claim for such losses. Amounts payable under clause 19 (damages, settlements, defence costs and, where clause 19.5 applies, regulatory penalties) are direct losses for the purposes of this clause and are not excluded by it.

18.3 Exceptions to clause 18.1 and 18.2. Clauses 18.1 and 18.2 do not apply to:

(a) liability that cannot be limited or excluded by law, including under UAE Civil Transactions Law Art. 296 (harmful acts), and death or personal injury caused by negligence;

(b) fraud, fraudulent misrepresentation, or wilful misconduct;

(c) the Customer's duty to pay Fees, which is a debt and not a limited liability;

(d) either party's indemnity under clause 19; and

(e) breach of clause 15 (confidentiality), other than breach relating to personal data, which clause 18.4 covers.

Liability under (d) and (e) is instead subject to the aggregate cap in clause 18.4. Liability under (a) and (b) is uncapped only to the extent the law does not allow it to be limited.

18.4 Aggregate cap for data protection, indemnities and confidentiality. Each party's total aggregate liability for breach of the DPA, under the indemnities in clause 19 and for breach of clause 15 is limited to two (2) times the Fees payable for the twelve (12) months following the Subscription Start Date (the "12-month contract value"), except that the Customer's liability under clause 19.2(a), (b) and (c) (claims caused by the Customer's breach of law or of clauses 6 and 7, and allergen and food-safety claims) is not subject to this cap or to clause 18.1.

18.5 Nothing in this clause limits a party's liability to a data subject or a regulator where the law makes that liability direct and non-excludable.

18.6 Agreed allocation of risk and exclusive remedies. The parties, each acting as an experienced commercial party with the opportunity to take advice, agree that:

(a) the limits and exclusions in this clause 18 are a mutually agreed and fair allocation of commercial risk between them, are reflected in the Fees, and represent a genuine pre-estimate of the loss each party should bear, and neither party will ask a court or tribunal to reassess them under UAE Civil Transactions Law Art. 390 or any similar rule;

(b) the remedies expressly stated in this Agreement (including service credits where an Order Form grants them, the refund rights in clause 12, the indemnities in clause 19 and the termination rights) are each party's sole and exclusive remedies for the matters they address, to the fullest extent the law allows;

(c) the exclusion of consequential and other losses in clause 18.2 applies equally to claims in tort, including negligence, and to any concurrent or alternative claim, so that a party cannot recover in tort what this clause excludes in contract; and

(d) each limit in this clause applies to the aggregate of all claims of any kind, and the Customer's affiliates and each Venue claim only through the Customer.

19. Indemnities

19.1 By PalmDine. PalmDine will defend the Customer against a third-party claim that the Services, used in line with this Agreement, infringe that third party's intellectual property rights, and will pay the damages and costs finally awarded or agreed in settlement. PalmDine has no duty where the claim arises from Customer Data or the Customer's instructions; from AI Output generated from the Customer's content, menu or instructions; from open-source components used within their licences; from the Customer's changes to or combinations of the Services with anything PalmDine did not supply; from use in breach of this Agreement; or from continued use after PalmDine offered a non-infringing alternative. PalmDine may, at its choice, modify the Services, obtain a licence, or end the affected Module and refund prepaid Fees for the remainder of the paid period. This clause is the Customer's sole and exclusive remedy for a claim that the Services infringe intellectual property rights.

19.2 By the Customer. The Customer will defend PalmDine, its affiliates and their personnel against a third-party claim, including a claim by a regulator, a Guest or the Customer's own personnel, and will pay the damages, settlements and costs (including reasonable legal fees) finally awarded or agreed, where the claim arises from:

(a) the Customer's breach of a law that applies to its use of the Services, including a missing consent, notice, age check, guardian consent or permit (for example the Qatar PDPPL Art. 16 permit), marketing sent through the Services without the consents the law requires, or call recording switched on where the law does not allow it;

(b) the Customer's breach of clause 6 or 7, including use of the Services by its staff or through its accounts in a way this Agreement does not allow;

(c) the Customer's goods and services to Guests, including any allergen, dietary, food-safety or personal-injury claim, whatever information the Services displayed or the AI host or waiter gave, since the Customer's menu data and Configuration are the source of that information and the Customer's staff serve the meal;

(d) Customer Data that is inaccurate, unlawful or infringes a third party's rights, or the Customer's Configuration;

(e) systems the Customer connects to the Services (Annex B Part B) and data flowing to or from them at the Customer's instruction;

(f) taxes the Customer must bear under clause 10.4 or a country rider; and

(g) claims by the Customer's employees, workers or job candidates in relation to the People Module or the Customer's employment practices.

19.3 Process. The indemnified party must tell the other promptly, and in any case within five (5) Business Days of learning of a claim or of contact from a regulator or a Guest about it, give the indemnifying party control of the defence and settlement, cooperate at the indemnifying party's reasonable cost, and take reasonable steps to mitigate the loss. PalmDine may keep control of the defence of any claim that also concerns the Services as offered to other customers or the platform itself, in which case the Customer's duty under clause 19.2 is to pay the amounts that clause names. No settlement that admits fault by, or imposes an obligation on, the indemnified party may be made without its written consent, not to be unreasonably withheld.

19.4 Cap. PalmDine's liability under clause 19.1, and the Customer's liability under clause 19.2(d) to (g), are subject to the aggregate cap in clause 18.4. The Customer's liability under clause 19.2(a), (b) and (c) is not capped (clause 18.4).

19.5 Regulatory penalties. Where a regulator imposes a penalty on PalmDine as a consequence of the Customer's instructions, Configuration or breach of this Agreement or of the law, the Customer compensates PalmDine for that loss as damages for the breach, to the extent the law of the relevant country allows such loss to be recovered. Where a regulator imposes a penalty on the Customer as a consequence of PalmDine's breach of the DPA, PalmDine's liability is governed by clause 18.4. Nothing in this clause obliges a party to indemnify a penalty that the law of the relevant country does not allow to be shifted.

20. Force majeure

20.1 Neither party is liable for a delay or failure caused by events beyond its reasonable control, such as natural disaster, war, terrorism, civil unrest, epidemic, government action, failure of a public network or a major cloud provider outage, labour dispute (other than of its own staff), or a cyberattack that reasonable security measures could not prevent.

20.2 The affected party must tell the other promptly and take reasonable steps to limit the effect. This clause does not excuse payment of Fees due.

20.3 If a force majeure event stops performance for more than 30 days, either party may terminate the affected Order Form by notice, and PalmDine will refund prepaid Fees for the period after termination.

21. Governing law and disputes

21.1 Governing law. This Agreement and any non-contractual obligation arising from it are governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai.

21.2 Negotiation. The parties will first try to resolve any dispute by good-faith negotiation for 30 days after written notice, as the published Terms provide (clauses 18 and 19).

21.3 Arbitration. Any dispute not resolved by negotiation will be finally resolved by arbitration administered by the Dubai International Arbitration Centre (DIAC) under the DIAC Arbitration Rules 2022, seated in Dubai (onshore), United Arab Emirates, before a sole arbitrator, in English. The award is final and binding.

21.4 Urgent relief. Either party may seek urgent interim or injunctive relief from any competent court.

21.5 Mandatory local law. Where mandatory law of the country where a Venue operates applies and cannot be excluded by choice of law, including mandatory consumer, commercial, data-protection or language rules, that law prevails to the extent of the conflict. The country riders in Annex C list known cases.

21.6 Data-transfer clauses. Where the DPA incorporates the EU Standard Contractual Clauses, the UK Addendum, or the Turkish standard contract, their own governing-law and forum clauses apply to disputes under them (DPA clause 11).

22. Notices

22.1 Notices under this Agreement must be in writing and sent by email to the addresses in the Order Form, or by courier to the registered address.

22.2 Notices to PalmDine: contract and legal notices to legal@palmdine.ai; privacy matters to dpo@palmdine.ai; courier to PalmDine AI - FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates.

22.3 An email notice is received when sent, unless the sender receives a delivery-failure message. A courier notice is received on delivery.

22.4 Operational messages, such as change notices under clause 13 or subprocessor notices under DPA clause 6, may also be given in the console.

23. Assignment and subcontracting

23.1 Neither party may assign this Agreement without the other's written consent, which must not be unreasonably withheld. Either party may assign it without consent to an affiliate, or to a buyer of all or most of its relevant business, by notice.

23.2 PalmDine may subcontract parts of the Services. It remains responsible for its subcontractors. Subprocessors of personal data are governed by DPA clause 6.

24. General

24.1 Entire agreement. This Agreement is the whole agreement between the parties about its subject. It replaces any earlier agreement or understanding. Neither party relies on any statement not set out in it. This does not limit liability for fraud.

24.2 Order of precedence. If the documents that make up this Agreement conflict:

(a) Personal data. On any point about the processing or protection of personal data, the DPA and its annexes prevail over every other document, including an Order Form. The data-protection terms of a country rider form part of the DPA for Venues in that country (DPA clause 1.5). Incorporated transfer clauses prevail on their own subject (DPA clause 11.4).

(b) All other terms. On any other point, including commercial terms, this order applies: (1) the Order Form, for the point it expressly changes; (2) the country rider, for Venues in the country it covers; (3) this MSA; (4) the DPA.

(c) Limits. An Order Form cannot change a rider term that reflects mandatory law of the Venue's country (clause 21.5), or the DPA.

(d) Published Terms. The published AIDA Terms & Conditions apply to the Customer only for matters this Agreement does not cover (Terms clause 30).

24.3 Authority. The person who signs or accepts an Order Form confirms that they are authorised to bind the Customer. PalmDine may ask for evidence, such as a trade licence, a power of attorney or a board resolution.

24.4 Counterparts and electronic signature. This Agreement may be signed in counterparts and by electronic signature or electronic acceptance. The parties agree that an electronic record and signature have the same effect as a written, hand-signed one, in line with UAE Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services. The parties use DocuSign (or another electronic-signature service PalmDine names) unless the law of the Venue's country requires a qualified electronic signature or wet ink, in which case the country rider says so (Türkiye: Annex C §1.3).

24.5 Language. This Agreement is written in English. If it is translated, the English version prevails, unless a country rider says otherwise (Annex C §1.3).

24.6 Independent parties. The parties are independent contractors. Nothing creates a partnership, agency or employment relationship.

24.7 No third-party rights. No one other than the parties may enforce this Agreement, except data subjects where the DPA or a transfer clause gives them rights.

24.8 Waiver and severability. A failure to enforce a right is not a waiver. If a provision is invalid, the rest continues, and the parties will replace it with a valid provision closest to their intent.

24.9 Anti-bribery and sanctions. Each party will comply with the anti-bribery, anti-money-laundering and sanctions laws that apply to it.

25. Country riders

25.1 The Order Form selects the country riders in Annex C that apply to the Customer's Venues. A rider adds to or changes this Agreement only for Venues in that country.

25.2 PalmDine may add new riders when it enters a new country. A new rider applies to an existing Customer only when it adds a Venue in that country, or under clause 13.

26. Signature block

26.1 The parties normally enter into this agreement by signing or accepting an Order Form, which incorporates it by reference (clause 3.1). The block below is used only where the parties sign this MSA on its own.