Clock Service Terms

Version 5.0

Effective 28 September 2026

CONTENTS

• Preamble
• Part I Subject matter and scope — Clauses 1 – 3
• Part II Definitions — Clause 4
• Part III Performance of the Service
  • Clauses:
  • 5. General
  • 6. Third-parties' components
  • 7. Use of the Service, modifications
  • 8. Ownership
  • 9. Compliance with regulatory requirements
  • 10. Data and information security
  • 11. Service level
  • 12. Support;
  • 13. Non-compliance of the Service
• Part IV Limitation of liability — Clause 14
• Part V Termination. Switching, transition and data retrieval
  • V.A Termination by Affiliated Hotel
    • Clauses:
    • 15. Notice period
    • 16. Transitional period
    • 17. Data retrieval period
    • 18. Switching assistance
    • 19. Group structures, shared data and technical limitations
    • 20. Fees during the notice period and the transitional period
    • 21. Data after termination
  • V.B Termination by Clock — Clause 22
• Part VI Government and public authorities access — Clause 23
• Part VII Service Vendors and Resellers — Clauses 24 – 26
• Part VIII New versions of the Service Terms — Clause 27
• Part IX Law and jurisdiction — Clause 28
• Part X Transitional provisions: Substitution of the vendor of the Service
  • Clauses:
  • 29. Release of Clock Software
  • 30. Payment arrangements
  • 31. Value added tax (VAT)
• Addendums:
  • Addendum 1: Data Processing
  • Addendum 2: Data Portability

Preamble

Whereas

1. Klok AD has developed and provides a complete and integral cloud-based hotel management system, including software services for hotel operations, digital guest engagement and payment automation. Klok AD is the holder of the title in all software used for performance of said services, including all copyrights, intellectual property rights, source code, trademarks and related proprietary rights forming part of it.

2. Clock Software acts as a global reseller and commercial representative of the above services under the Clock brand. Clock Software does not host, process or otherwise have access to the customers' data.

3. Within the Clock Group, Klok AD is the actual provider of all services and is data processing services provider within the scope of the Regulation (EU) 2023/2854, whilst Clock Software Ltd. is the vendor of those services under the agreements with the customers of the Clock Group.

4. Regulation (EU) 2023/2854 has introduced new regulations of the data services and new requirements to the data services providers

5. Clock Group is willing to adjust the way of providing its services to the requirements of the Regulation (EU) 2023/2854 and to that end to introduce necessary amendments to its Service Terms.

6. For the purpose under the above recital (5) Klok AD shall, inter alia, substitute Clock Software ltd. as a vendor of the Clock Group services in all agreements with the customers of the Clock Group, either current or future.

These Version 5.0 of the Service Terms are adopted.

I. Subject matter and scope

1. These Service Terms contain the general terms of the Clock Group for provision of the Service. The Service Terms apply to each and every Affiliation Agreement between an Affiliated Hotel and Klok AD or Clock Software Ltd. or Clock Group.

2. In an event of contradiction between an Affiliation Agreement and the Service Terms the respective provisions of the Affiliation Agreement shall prevail, unless otherwise stated in these Service Terms.

3. The Service Terms current on the date of conclusion of an Affiliation Agreement shall apply to the said Agreement. Further versions of the Service Terms might become applicable only under the terms of clause 27.

II. Definitions

4. For the purpose of these Service Terms the following definitions apply.

1. Clock means Clock Group including:
   • Klok AD, having its registered address at Office 504, Sgrada B8, Biznes Park Varna, Varna 9009, Bulgaria, registration number (BULSTAT) 207049288, VAT number BG207049288; and
   • Clock Software Ltd., with its registered address at 27 Redcliffe Gardens Str, SW10 9BH, London, United Kingdom, registration number 08008667, UK VAT number GB 171 9019 10, EU VAT number EU100001612 (Clock Software).
2. Affiliated Hotel means a customer who operates a hotel or other accommodation premises and uses the Service under the terms of an Affiliation Agreement. The term Affiliated Hotel might be as well used to refer to the accommodation premise operated by the respective customer, depending on the context.
3. Affiliation Agreement means an agreement for implementation and use of the service, made by and between Clock Group and an Affiliated Hotel.
4. Service means the services described in recital (1) of the Preamble.
5. Service Fee means the fee agreed if an Affiliation Agreement made for an unlimited period.
6. Discounted Service Fee means the discounted fee granted to an Affiliated Hotel in consideration of its commitment to use the Service for a certain period, the discount rate and the contractual period being stated in the respective Affiliation Agreement.
7. Service Provider means Klok AD.
8. Service Vendor means an entity which sells the Service to an Affiliated Hotel by an Affiliation Agreement, which could be the Service Provider or a Reseller.
9. Reseller means any entity different from the Service Provider which sells the Service to an Affiliated Hotel by an Affiliation Agreement.
10. Subscription means full access to the Service granted to an affiliated Hotel under an Affiliation Agreement.
11. Restricted Access Subscription means restricted access to the Service granted to an affiliated Hotel under an Affiliation Agreement
12. Retention Period means a period of 12 consecutive months of termination of an Affiliation Agreement, in which period Clock shall store the data of the respective Affiliated Hotel.

All terms contained in the Regulation (EU) 2023/2854 which are used in these Service Terms have the same meaning as in the Regulation (EU) 2023/2854 or in Regulation (EU) 2016/679.

III. Performance of the Service

5. General

5.1 Klok AD develops, provides, hosts and processes the Service and the Affiliated Hotel's data within the European Union (EU). Klok AD is based and operates in Bulgaria. The hosting infrastructure is located in Ireland. No hosting, storage or backup of the Affiliated Hotel's data takes place outside the European Economic Area.

5.2 Clock Software Ltd. acts solely as a Reseller and does not host, process or otherwise have access to the Affiliated Hotel's data.

5.3 Service Provider's sub-processors and their processing locations are listed in the Addendum 1. If a sub-processor or an affiliate of a sub-processor provides support, maintenance, operational or security services from a location outside the European Economic Area, any resulting access to data is subject to the safeguards set out in the Addendum 1.

5.4 Clock undertakes to provide the service in compliance with these Service Terms, the respective Affiliation agreements and the applicable regulations.

5.5 The Affiliated Hotel shall be responsible for the configuration and use of the Service, and all results achieved from it are at its own risk and for its own benefit.

6. Third-party components

6.1 Any third-party components and/or services included in the Service shall be listed in the respective Affiliation Agreements, referencing the third-party's legal details and, where possible, the said third-party's terms of use. Such third-party terms shall be binding upon the Affiliated Hotel.

6.2 Clock shall bear no liability to the Affiliated Hotel for defects, malfunctions or errors in third-party components or services. The Affiliated Hotel may not claim non-compliance incidents, including service level failures, where such failures are directly attributable to a defect in a third-party component, including any loss or destruction of data caused by it. This limitation shall not apply where Clock was, or should have been, able to limit the scope or consequences of the error. Upon request, or where economically feasible and necessary, Clock shall assist the Affiliated Hotel in communication with the relevant third party.

7. Use of the Service and modifications

7.1 Use "as is" and updates

7.1.1 The Affiliated Hotel shall use the Service and all Service updates in their standard form.

7.1.2 Service updates and general maintenance are included in the Agreement without additional remuneration.

7.1.3 Clock holds the exclusive right to design, develop and implement the Service features and the content of standard updates.

7.1.4 Clock is not obliged to implement or modify specific Service features upon request. The implementation of any suggestion by an Affiliated Hotel shall not grant the Affiliated Hotel or any third party any intellectual property rights or compensation.

7.1.5 Clock is exclusively entitled to apply at its sole discretion system updates, including as to timing.

7.1.6 Cessation of prior versions: Upon implementation of a Service update, access to the prior version of the Service, including the graphical user interface, business logic and outputs, shall cease. The Affiliated Hotel is not entitled to claim any service modification or compensation as a result.

7.2 Application programming interface

7.2.1 Clock provides an application programming interface ("API") giving access to the Affiliated Hotel's data in a structured, commonly used and machine-readable format.

7.2.2 Clock shall grant registered API access to the Affiliated Hotel and to any third party appointed by the Affiliated Hotel. Such third parties may include integration providers, developers, consultants, and providers of competing or alternative services acting on the Affiliated Hotel's behalf. For the purposes of the data retrieval in case of switching Clock shall not refuse, restrict or condition API access by reason of the identity or business of an appointed third party. For all other cases than switching, Clock may require the signing of an Integration agreement and / or be entitled to apply certification and / or API usage fees.

7.2.3 Clock maintains public technical documentation of the API, including authentication, available resources, data structures and formats, at https://developers.clock-software.com. Clock publishes at the same location reference examples demonstrating the extraction of the Affiliated Hotel's principal data categories. The reference examples are provided for information, without warranty, and outside the scope of the Support.

7.2.4 API access is subject to rate limits applied uniformly to all Affiliated Hotels for the purpose of preserving Service operability. The current rate limits are published in the API documentation. Clock shall not apply differentiated rate limits by reason of an Affiliated Hotel's switching to another data service provider.

7.2.5 In respect of the API endpoints by which the Affiliated Hotel's exportable data is retrieved or exported, Clock shall give not less than three months' notice of any change which would require the Affiliated Hotel or an appointed third party to modify an existing extraction, save where a shorter period is required to address a security vulnerability. In respect of all other API endpoints, Clock shall notify changes which would require modification of an existing integration as early as is reasonably practicable, and in any event not later than the date on which the change is made available.

7.2.6 The Affiliated Hotel and any appointed third party are responsible for their use of the API and for the data transmitted through it. All data transfers and storage performed via the API are on the Affiliated Hotel's behalf, account and responsibility.

7.3 Fair Use Policy

7.3.1 Compliance: This Fair Use Policy ensures fair and sustainable use of the Service. Repeated or material violations of this policy may result in fee adjustments, additional charges or service suspension, subject to the Service Terms and/or the respective Affiliation Agreement.

7.3.2 Fair API Usage
Each Service account includes 50 hours (180,000,000 milliseconds) of API central processing unit (CPU) processing time per month. Additional consumption is charged at €1, $1.20, £0.9 per CPU hour.

7.3.3 Exportable Rates: Each Service account includes up to 100 exportable rates for distribution systems + 100 additional ones for the direct integration with Booking.com, with no limit on the number of downloadable rates. Affiliated Hotels are encouraged to use rate derivation features in channel managers or computer reservation systems (CRS) for efficient rate management. Additional exportable rates may be enabled upon request and may incur additional fees.

7.3.4 Revenue Reporting and Pricing Integrity: Affiliated Hotels shall provide realistic revenue estimates and ensure that reported revenue accurately reflects their actual business activity. Artificially inflating or reducing revenue estimates, excessive credits, cancellation of genuine bookings, or other practices intended to manipulate Service Fees shall be subject to the following revisions:
a) If actual revenue deviates by more than 20% from the estimate, Clock may review the applicable fees and recalculate them using the standard base rate without commercial discounts.
b) Where revenue reporting is found to have been manipulated, Clock reserves the right to calculate fees based on benchmark revenue, determined using publicly available room rates (including rates published on the hotel's website or online travel agencies) and an estimated occupancy rate.

8. Ownership

8.1 Neither these Service Terms nor an Affiliation Agreement transfer any copyright, right of disposal or property titles. Access to the Service confers only the right to use it in accordance with the Affiliation Agreement. No intellectual property rights are transferred to the Affiliated Hotel, nor shall any Affiliated Hotel have exclusive access to the Service.

8.2 The Affiliated Hotel remains the exclusive owner of all data stored or processed throughout the performance of the Service. Clock shall access the data only to the extent necessary for the performance of the Service.

8.3 Clock may not withhold the Affiliated Hotel's data. Clock is however entitled to suspend or restrict access to the Service where the Affiliated Hotel fails to rectify a breach of its obligations, including a failure to pay Fees,. No suspension or restriction of access on any ground shall prevent, delay or condition the retrieval or export of the Affiliated Hotel's data, the assistance under clause 18, or the running of the notice period, the transitional period and the data retrieval period under clauses 15- 17.

9. Compliance with regulatory requirements

9.1 Through all the time of using the service The Affiliated Hotel is solely responsible for the compliance with all local fiscal, legal and other regulatory requirements at its place of business.

9.2 Unless Clock holds a compliance registration with a local regulatory agency, provides a certificate from an authorised certification body, or issues a self-assessment compliance declaration:

a) the Affiliated Hotel is solely responsible for assessing the Service's compliance with Regulatory Requirements.

b) the Affiliated Hotel must notify Clock in writing immediately if the Service is or becomes non-compliant, or if its use or provisioning becomes subject to local registration, approval or certification.

c) the Affiliated Hotel shall immediately cease using the Service or take all necessary provisional actions to make its use compliant.

9.3 Where the Service is not compliant with local Regulatory Requirements, Clock shall be entitled either to take corrective action to rectify the non-compliance or to notify the Affiliated Hotel that compliance is not feasible.

9.4 In an event of non-compliance with regulatory requirements, the Affiliated Hotel shall not be entitled to compensation or fee reduction but shall be entitled to terminate the Agreement without cancellation fees and without any amount being payable in respect of the recovery of discounts.

9.5 The Affiliated Hotel shall indemnify and hold Clock harmless against any penalties, legal fees or expenses whatsoever, arising from actions by local authorities or interested third parties regarding the performance of a non-compliant Service, in particular where such action is a consequence of the Affiliated Hotel's failure to cease use of the Service after becoming aware of the non-compliance, and unless Clock has provided a compliance registration, certificate or declaration.

10. Data and information security

10.1 Information security

10.1.1 Clock shall implement appropriate measures to meet the information security requirements associated with the performance of the Service, including:

a) ensuring the confidentiality of the Affiliated Hotel's data;

b) protection against unauthorised access, unintended modification and deletion of data, and against malware attacks;

c) implementation and maintenance technical measures to keep the Affiliated Hotel's data separate from third-party data, securing it against unintended change or access, including access by Clock's employees or others who do not require the information for their work for the Affiliated Hotel.

10.1.2 The Affiliated Hotel is obliged to implement and maintain systematic measures for data security and the protection of personal, payment card and other sensitive data, including managing user rights, controlling transaction logs, establishing retention policies and staff training.

10.1.3 The Affiliated Hotel undertakes to use the API responsibly and in compliance with all personal and general data security regulations and best practices. All data transfers and storage performed via the API shall be on the Affiliated Hotel's behalf, account and responsibility.

10.2 Personal data protection and roles

10.2.1 The Affiliated Hotel is the Data Controller of the personal data processed through the Service in connection with its own operations. Klok AD is the Data Processor. Where the Affiliated Hotel forms part of a Group and its Service account is provisioned within a Service subscription controlled by that Group, the Group and the Affiliated Hotel may be joint data controllers in respect of data shared across Service accounts within that subscription, on the terms of the joint controller arrangement between them.

10.2.2 Clock shall ensure satisfactory information security, confidentiality, integrity, accessibility and robustness in the processing of personal data through planned and systematic measures. The specific measures for compliance with data protection law, including the GDPR, are set out in the Data Processing Addendum 1, which is an integral part of these Service Terms.

10.2.3 Clock may not entrust personal data to other parties for storage, reworking or deletion without the Affiliated Hotel's prior written permission or without the activation of the connection from the Clock GUI, except for the sub-processors listed in the Data Processing Addendum 1. Clock shall ensure that any sub-processor processing personal data assumes obligations equivalent to those set out in the Data Processing Addendum 1.

10.2.4 The Affiliated Hotel is solely responsible for personal data transmitted via the API to any third-party system or repository, even where the integration has been certified by Clock.

11. Service levels

11.1 Service availability is calculated per calendar month as follows:

Availability = ( 1 − (N − P) / D ) × 100.
P: downtime due to planned maintenance, including Service upgrades, for which written notice was issued at least one day in advance (a written or on-screen notification within the Service qualifies).
D: operating time, being the total time in the calendar month.
N: downtime due to reasons for which Clock is responsible, excluding force majeure, or, any events beyond Clock's control or any events, and factors attributable within the control of to the Affiliated Hotel.

11.2 Performance Warranty

11.2.1 Performance is measured by internal server metrics — application server response time, being the time from receipt of the request to the client response — calculated per calendar month. The following criteria shall apply:

a) Metrics considered: acceptance, authentication and processing of the request; processing of business rules; reading of database records; server-side composition of pages and partials; and passing the response to the client.

b) Metrics not considered: transport time of the request and response over LAN or internet, and client-side browser rendering time.

11.2.2 Two standards shall be used: average response time and 90th percentile response time. Values are measured as average values of discrete one-hour intervals. Separate metrics apply to the core application (APP) and the API servers (API).

a) Application server average response time (APP and API)

b) Application server response time (APP) — 90th percentile

API 90th percentile: due to the variable nature of API requests, Clock offers no guarantee for this metric.

11.3 Monitoring and claims

11.3.1 Execution of the Service Level Agreement for both availability and performance can be monitored online at the Service Status page. Clock may use additional logs and evidence when reviewing a claim only where the public independent monitoring detects a false positive decrease of availability or performance.

11.3.2 To claim compensation or a fee reduction, the Affiliated Hotel must send Clock a written request by the 15th day of the month following the month claimed for, stating the figures from the monitoring tools. Clock shall review the claim within a maximum of 10 days and, where no evidence of false signals, planned maintenance or other excluded factors is found, issue a credit note.

11.3.3 Clock may reject a claim only if, inter alia:

a) the figures cited do not match the monitoring tool; оr

b) the claim is submitted after the 15th day of the subsequent month; or

c) Clock proves with logs and evidence that false positives, planned maintenance, actions of the Affiliated Hotel or force majeure impacted the registered metrics.

12. Support

12.1 Scope

Support addresses the resolution of Support Incidents, being:

a) any request, enquiry or incident that is not a Non-compliance Incident, downtime or significantly degraded system performance;

b) incidents related to the specific manner in which the Affiliated Hotel uses or wishes to use the Service, as opposed to the Service's functioning, and incidents related to the local technical infrastructure of the Affiliated Hotel or dependent users.

Examples include training requests, how-to questions, configuration review, data discrepancy review, and integration disruption review.

12.2 Covered incidents

12.3 Exclusions

The following is are expressly excluded from the scope of Support:

a) project management and implementation guidance;

b) investigation of online distribution issues and discrepancies beyond the review of log files, business or tax consultations;

c) system administration and incidents related to the Affiliated Hotel's local area network, internet connectivity, operating system, virus protection or third-party systems;

d) repetitive or recurring incidents resulting from the Affiliated Hotel's failure to implement a previously suggested reasonable resolution provided by Clock;

e) development and customisation services, including printout or template customisation;

f) integrations with third-party systems not developed by Clock, including issues related to API usage;

g) sales, account management, invoicing and billing enquiries and requests.

Excluded incidents may be offered as setup or professional services under the terms stipulated in the Agreement.

12.4 Support coverage and volume

12.4.1 Guaranteed Coverage. Clock shall be available to work on resolving covered incidents submitted by the Affiliated Hotel, without further remuneration, within the scope of the Guaranteed Work Volume, Response Time and Working Time stipulated in the Affiliation Agreement.

12.4.2 Standard levels as a floor. The Guaranteed Work Volume, Response Time and Working Time applicable to an Affiliated Hotel are stipulated in the Affiliation Agreement. Where the Affiliation Agreement does not stipulate them, or stipulates levels lower than the standard levels in sub-clauses 12.4.3 and 12.5, the standard levels apply.

12.4.3 Standard Guaranteed Work Volume. Without setting a fixed limit, the guidance is that the Guaranteed Work Volume should not exceed four hours per calendar month.

12.4.4 Non-Guaranteed Coverage. Clock undertakes to use its best efforts, subject to availability, to resolve covered incidents exceeding the Guaranteed Work Volume. Clock has no obligation or liability to meet response or resolution times for such incidents, nor any liability for any remedy or compensation where it is unable to or fails to deliver work under Non-Guaranteed Coverage.

12.4.5 Measurement. The Guaranteed Work Volume is measured by the time effectively worked on all actions of Clock's support representatives, including accepting, analysing, diagnosing, applying, liaising with third parties, communicating and documenting the actions on resolving covered incidents.

12.4.6 Independence from switching. The support levels applicable to an Affiliated Hotel shall not vary by reason of the Affiliated Hotel having given notice or exercised any right under clause 15.

12.5 Response time and working time

12.5.1 Standard Working Time, unless otherwise stipulated in the Affiliation Agreement:
Working days: 08:00 to 22:30 Central European Time.
Weekends and holidays: 10:30 to 19:30 Central European Time.

12.5.2 Standard Response Time, unless otherwise stipulated in the Affiliation Agreement, is four hours. The Response Time is the period between acceptance of the Affiliated Hotel's report of a support incident and the moment Clock commences efficient work on its resolution. It is counted exclusively within Working Time.

12.6 Communication and registered users

12.6.1 The Affiliated Hotel shall submit Support Incidents and conduct all consequential communication exclusively via the official communication channels stipulated in the Affiliation Agreement, which may include:

a) in-app support chat (recommended);

b) Clock's support portal, via registered support user login;

c) email, at the standard address stipulated in the Affiliation Agreement.

12.6.2 Submissions or communications relating to the resolution of Support Incidents not directed to the official communication channels shall be deemed invalid and shall not lead to any default or liability for Clock. In the resolution phase Clock may use chat, email, telephone, remote control, in-app actions, online meetings, or a combination, as deemed optimal.

12.7 Incident process and obligations

12.7.1 Reporting. For each Support Incident submitted via the official communication channels, Clock shall open a support ticket and assign a unique ticket number. Submissions may be made at any time.

12.7.2 Resolution obligations. The Affiliated Hotel shall, at all times and at its own expense:

a) execute Clock's instructions directly or via third-party service providers;

b) ensure all technical and system requirements communicated by Clock are met;

c) upon Clock's request, provide remote access, evidence, log files, diagnosis assistance or other evidence related to the resolution of the Support Incident or the functioning of the Service;

d) provide cooperation from any third party required for resolution or for assuring compliance with Clock's technical and system requirements.

12.7.3 Ticket closing. Both parties may close a support ticket. Clock is entitled to close a ticket where:

a) the Affiliated Hotel confirms the issue is resolved;

b) the incident has been objectively resolved;

c) the incident is not a covered incident;

d) after a reasonable idle time, the Affiliated Hotel fails to reply to Clock's requests or reminders; e) the incident results from a non-contracted feature or a feature request;

f) no resolution can be provided due to the current functionality of the Service or the objective nature of the incident, despite prompt and asserted efforts by Clock or its subcontractors.

The Affiliated Hotel may close a ticket at its own discretion.

12.7.4 Ticket reopening. The parties may re-open a closed ticket. Unless the ticket was closed by Clock on a ground other than those listed in sub-clause 12.7.3, the response and resolution times shall restart upon reopening.

12.8 Fair use of support

12.8.1 Support is designed to assist the Affiliated Hotel in the proper and efficient use of the Service. It is not intended to replace standard training, documentation or operational consulting, nor does it oblige Clock's staff to operate the Service on behalf of an Affiliated Hotel or supervise its personnel.

12.8.2 Support shall be considered unfairly, excessively or improperly used where:

a) an individual user or group of users repeatedly contacts Support for routine operational guidance or assistance with daily procedures already covered in documentation, training materials or prior responses;

b) requests are repetitive in nature, requesting re-explanation of previously provided instructions or recommendations without implementation of the suggested solutions;

c) Support is used for purposes outside its defined scope, such as process coaching, ongoing operational monitoring or business consulting, rather than for issues related to the functioning of the Service;

d) requests repeatedly relate to issues caused by the Affiliated Hotel's internal technological infrastructure or local environment, or by misconfigured third-party components or systems, where Clock has already provided written notice identifying the cause and the required corrective actions;

e) 4 (four) hours per calendar month for general incident support usage is exceeded on a repeated basis, where the excess is caused by misuse or persistent behaviour leading to repeated incidents. Time spent resolving Non-compliance Incidents is expressly excluded from this aggregation.

12.8.3 Where Clock identifies a pattern of unfair, excessive or improper use:

a) Clock shall provide written notice outlining the identified misuse and recommending a review of internal practices and available training resources;

b) if the behaviour persists, Clock shall be entitled to limit the scope of Support exclusively to critical incident resolution, to offer dedicated training or consulting as a paid service, and to apply a fair use fee of €100 per hour where Support is demonstrably and repeatedly used for non-support purposes following prior written notice;

c) continued misuse after written notice may entitle Clock to temporarily suspend non-critical Support responses until corrective measures are agreed and implemented.

No measure under this section shall apply to, limit or delay the assistance Clock is required to provide under clause 18.

12.9 Compensation provisions

12.9.1 Compensations shall be calculated and applied per calendar month. The maximum aggregate value of all compensations, for availability, performance, non-compliance and user support metrics, shall be limited to 100% of the fee applicable for the respective calendar month.

12.9.2 Compensations from the different metrics shall not be cumulative or applied in combination. Only the highest applicable compensation shall apply.

12.9.3 The price reduction detailed in sub-clause 12.9.1 constitutes the sole and exclusive compensation and remedy for any failure of Clock to meet its obligations under the Service Level Agreement or the Agreement generally, unless such failure is caused by deliberate act or gross negligence.

12.10 Emergency telephone line

The emergency telephone line for contacting Clock is +44 20 33979671 or +359 52 685 685.

13. Non-compliance of the Service

13.1 Compliance warranty

Clock warrants that standard Service features operate as intended per their release notes and specifications, without interruption or data loss.

13.2 Reporting and levels

The Affiliated Hotel shall report each instance of non-compliance incident (a "Non-compliance Incident") to Clock's Support Centre, which shall record it as a ticket. Clock shall respond according to the resolution targets below.

13.3 Level determination

The Affiliated Hotel shall reasonably self-diagnose and recommend a non-compliance level. Clock shall validate the designation or propose a change with justification. Conflicts shall be promptly escalated to management, during which time the issue will be handled according to Clock's designation. Both parties shall be available within one hour of escalation.

13.4 Resolve time standard

13.4.1 Resolve time is the period from reporting to the Affiliated Hotel being notified that the issue is resolved, less idle time.

13.4.2 Idle time is the aggregated time during which Clock is objectively unable to act due to dependence on input, feedback or action by the Affiliated Hotel or a third party not subcontracted by Clock. It also includes time used to correct consequences of the Affiliated Hotel's or third parties' actions or omissions.

13.4.3 Clock may close a ticket after a reasonable idle time where the Affiliated Hotel does not reply, in which case the resolve time is considered within target. The Affiliated Hotel may re-open the ticket, restarting the resolve time.

13.5 Compensations

IV. Limitation of liability

14. The liability of Clock under an Affiliation Agreement shall be limited to deliberate misconduct or gross negligence only. In no circumstances Clock shall be liable for lost revenues, lost profits, reputational damage, other financial losses, or indirect, consequential, exemplary, special or punitive damages, nor for any collateral negative effects arising from the use of the Service. The aggregate liability of Clock for claims under an Affiliation Agreement shall be limited to the compensations set out in sub-clause 12.9.1 but shall not exceed 100% of the fees actually paid for each calendar month affected by Clock's default. Clock shall have the option to compensate the Affiliated Hotel by granting benefits for using the Service.

V. Termination, switching, transition and data retrieval

V.A Termination by Affiliated Hotel

15. Notice period

15.1 Affiliated Hotel is entitled to terminate the Affiliation Agreement at any time, without stating a reason, by at least two-months prior notice in writing. In the said notice Affiliated Hotel shall specify which of the following actions it shall perform upon expiry of the notice period:

a) switch to a different provider of data processing services;

b) switch to an on-premises ICT infrastructure;

c) erase its exportable data and digital assets.

15.2 The said notice shall be sent via the relevant menu of the Service, in a digital form available exclusively to user accounts with assigned user rights to serve such notice.

15.3 Affiliation Agreement shall be considered terminated and the Affiliated Hotel shall be notified of the termination:

a) where applicable, upon the successful completion of the switching process;

b) at the end of the notice period, where the Affiliated Hotel does not wish to switch but to erase its exportable data and digital assets upon service termination.

16. Transitional period

16.1 If the Affiliated Hotel is willing to switch to a different provider of data processing services or to an on-premises ICT infrastructure, upon expiry of the notice period a 30-days transitional period shall commence. During the transitional period the Affiliation Agreement remains in force, accordingly Clock shall continue to provide the Service in full and Clock shall assist the Affiliated Hotel as per clause 18.

16.2 The Affiliated Hotel may by written notice, extend or terminate the transitional period confirming in writing that the switching process is completed. If no further extension has been requested or notice for terminating the transitional term has been given the switching shall be considered completed upon expiry of the transitional period, as extended. Clock may not shorten the transitional period.

16.3 Where Clock considers that the switching process cannot be completed within 30 calendar days for technical reasons, Clock shall notify the Affiliated Hotel within 14 working days of receipt of the notice of termination. In such an event Clock, shall duly justify the technical unfeasibility, and shall indicate an alternative transitional period not exceeding seven months.

17. Data retrieval period

17.1 Upon expiry of the transitional period (if any) a 30-days data retrieval period shall commence. Upon expiry of the said data retrieval period the Affiliated Hotel's exportable data and digital assets are shall be retained or erased as per clause 21.

17.2 During the data retrieval period the Affiliated Hotel shall have access to the Service only for the retrieval purpose, but shall not be entitled to any of the functions of the Service.

18. Switching assistance

18.1 During the notice period and the transitional period Clock shall provide free of charge the following assistance:

a) maintain full API access on the terms of sub-clause 7.3, including for third parties and providers of competing services appointed by the Affiliated Hotel;

b) maintain and make available the public API documentation and reference examples at https://developers.clock-software.com, describing the authentication method, the available resources, the data structures and formats, and the means of extracting each category of exportable data;

c) respond to reasonable technical enquiries from the Affiliated Hotel and its appointed third parties concerning the extraction and interpretation of the exportable data, within the response time set in sub-clause 12.5.

d) act with due care to maintain business continuity and continue the provision of the functions and services under the Agreement;

e) provide clear information concerning any known risks to continuity in the provision of the functions or services; and

f) maintain the integrity, availability, completeness and security of the exportable data.

18.2 The assistance under this section consists of the provision of access, documentation, information and technical responses. It does not include the performance by Clock of the extraction, transformation, mapping or loading of data on the Affiliated Hotel's behalf, which is available as an optional professional service under sub-clause 21.5.

18.3 During the notice period, the transition period and the data retrieval period the Affiliated Hotel may use the API, the export functions of the Service interface and/or any other means described in the Addendum 2. These means are available without charge at all times, and no chargeable service is required for the exercise of any right under this section.

18.4 Where a means of export is not active on the Affiliated Hotel's Service account, Clock shall activate it upon request, without charge and without undue delay.

19. Group structures, shared data and technical limitations

19.1 Where the Affiliated Hotel's Service account has been provided as a part of a Group Subscription, the rights under this section apply to the Affiliated Hotel only in respect of its own exportable data and are not conditional upon the consent, instruction or non-objection of the respective Group.

19.2 The exportable data of an Affiliated Hotel comprises the data attributable to its own Service account, including its reservations, folios, invoices and payments, its guest and company profiles, its rate and inventory configuration, its transactional and financial history, and the configuration of its Service account.

19.3 Certain data within a Service subscription might be shared across the Service accounts of all Affiliated Hotels within that Subscription. Such shared data includes 14. guest profiles, company profiles, user accounts, revenue groups and revenue categories. Where a shared record relates to more than one Affiliated Hotel, the Affiliated Hotel may retrieve the record together with the transactions attributable to its own Service account. Data and 16. transactions attributable exclusively to other Affiliated Hotels within the Subscription do not form part of the Affiliated Hotel's exportable data and are not retrievable by the Affiliated Hotel.

19.4 Service accounts are provided within a Subscription and cannot be reassigned to a different Subscription. Where an Affiliated Hotel ceases its affiliation with a Group and wishes to continue using the Service independently, a new Subscription and Service account shall be granted. Historical transactional data held in the previous Service account does not migrate to the new Service account. The Affiliated Hotel may retrieve that historical data under this section.

19.5 The categories of exportable data, the formats in which they are made available, and any categories excluded on grounds of the technical limitations described in this section or on grounds of trade secrets, are specified in the Addendum 2.

20. Fees during the notice period, the transitional period and the data retrieval period

20.1 Service Fees remain payable for the notice period and the transitional period.

20.2 The fees agreed in the Affiliation Agreement shall be payable for the notice period, within the ordinary billing cycle.

20.3 Where under the Affiliation Agreement a Discounted Service Fee has been granted to the Affiliated Hotel and notice period expires before the expiry of period agreed in the Affiliation Agreement term, the Affiliated Hotel shall refund to Clock the balance between the Service Fee and the Discounted Service Fee for the period from the commencement of the period last-agreed in the Affiliation Agreement till the expiry of the notice period. The refundable balance shall however not exceed 70% of the Discounted Service Fee for the period from the expiry of the notice period till the expiry date of the period last-agreed in the Affiliation Agreement.

20.4 The fees shall be invoiced monthly in advance, on the first day of each calendar month, pro rata. The first such invoice shall be issued on the first day of the transitional period. Any Fees paid in advance for a period following the actual termination of the transitional period shall be refunded pro rata.

Example

Standard Service Fee – EUR 500 per month
Affiliation Agreement period – 36 months
Discounted Service Fee – EUR 250 per month
Where termination notice period expires at the end of the 26th month:
Months elapsed - 26
Months remaining – 10
Discount granted to the Affiliated Hotel for the 26 elapsed months – EUR 6,500
Discounted service fees for the 10 remaining months – EUR 2,500

The Affiliated hotel shall pay EUR 1,750 (70% of 2,500)
Where termination notice period expires at the end of the 6th month:
Months elapsed – 6
Months remaining – 30
Discount granted to the Affiliated Hotel for the 6 elapsed months – EUR 1,500
Discounted service fees for the 30 remaining months – EUR 7,500
The Affiliated hotel shall pay EUR 1,500.

21. Data after termination

21.1 Upon expiration of the data retrieval period of an Affiliation Agreement the respective Affiliated Hotel's Service account shall be closed and the access to the Service shall be ceased. If the Affiliated hotel has not requested erasure of its exportable data and digital assets Clock shall retain the said data and assets for a period or of 12 months ("Retention Period"), at no cost for the Affiliated Hotel.

21.2 During the Retention Period the data shall not be accessible. Clock shall erase the data upon expiry of the retention Period. Upon request of the Affiliated Hotel Clock shall erase the data any time before the expiry of the Retention Period, at no cost for the Affiliated Hotel.

21.3 Until the expiration of the data retrieval period the Affiliated Hotel may retrieve its exportable data and digital assets free of charge, upon written request to Clock,

21.4 Clock may retain Affiliated Hotel's data after expiry of the retention Period if required by law or for legitimate backup, archival, fraud prevention, security or compliance purposes, and shall not use such data for any other purpose.

21.5 After termination of an Affiliation Agreement, at the request of the respective Affiliated Hotel Clock may provide the following optional services:

a) Release or temporary retrieval access — after expiry of the one-months free-of-charge data retrieval period under clause 17, Clock makes the retained data available to the Affiliated Hotel in the appropriate formats, or provides temporary access to the Service for the purpose of retrieving it, for a fixed one-time fee.

b) Extended retention — Clock keeps storage of the data after expiry of the retention Period, for a monthly fee.

c) Reactivation — Clock restores the Service in full and the Affiliated Hotel resumes use of its existing Service account with its configuration and transactional history intact, without a new implementation, on terms agreed between the parties.

d) Restricted Access Subscription — which for a monthly fee grants access to the Affiliated Hotel's existing data for reference, reporting and record-keeping purposes only. It does not permit operational use of the Service, including the creation or modification of reservations, folios, invoices, payments or other transactions. Integrations with third-party systems and write access to the API are not available. The scope of access is set out in the Service specifications.

21.6 The fees for the above optional services are set out in the respective Service specifications or will be agreed in a separate agreement.

21.7 If the Affiliated Hotel fails to pay the fees for agreed Extended retention or Restricted Access Subscription Clock shall notify the Affiliated Hotel and may erase the data if no payment is made in 30 days of the notice.

V.B Termination by Clock

22.1 Clock may terminate Affiliation Agreement by 30-days notice in writing, if Affiliated Hotel has failed to pay the service fees or tries to modify the service and fails to rectify its breach within the notice period.

22.2 Clock may terminate an affiliation Agreement by a notice in writing with immediate effect if Affiliated Hotel uses the service for the purpose of any illegal activity and/or for providing services in breach of any law, regulations, restrictions or sanctions introduced by any government or international body.

22.3 Upon termination of the Affiliation Agreement the Affiliated Hotel's account shall be closed and the access to the Service shall be ceased. Clock shall retain the said data and assets for a a period of 30 days, in which the Affiliated Hotel must notify Clock whether it shall:

a) switch to a different provider of data processing services, in which case the Affiliated Hotel shall provide the necessary details of that provider; and/or

b) switch to an on-premises ICT infrastructure; and/or

c) erase its exportable data and digital assets.

22.4 If affiliated Hotel fails to notify Clock as per sub-clause 22.3, Clock shall erase the data upon expiry of the 30-days retention period.

22.5 If Clock has been notified as per sub-clause 22.3, clauses 15 - 20 shall apply accordingly.

VI. Government and public authority access

23.1 Where Clock receives a request or order from a public authority of a third country for the transfer of, or access to, data held for the Affiliated Hotel under the Agreement, Clock shall comply only where the request or decision is based on an international agreement in force between that third country and the EU or a Member State.

23.2 In the absence of such an agreement under the above sub-clause, and where compliance risks conflict with the EU or Member State law, Clock shall comply only where the requirements of Article 32(3) of Regulation (EU) 2023/2854 are met, including that the decision is reasoned and proportionate, that it is subject to review by a competent court or tribunal of the third country, and that the reviewing body is empowered to take due account of the relevant legal interests of the provider of the data.

23.3 In any case Clock shall provide the minimum amount of data permissible in response to any such request or order.

23.4 Clock shall notify the Affiliated Hotel of any such request or order before complying, unless prohibited by law, in which case Clock shall notify the Affiliated Hotel as soon as the prohibition ceases to apply. Where the request concerns personal data, Clock shall seek the prior opinion of the competent supervisory authority where required.

23.5 This section applies to all data held for the Affiliated Hotel, whether or not it constitutes personal data.

VII. Service vendors and Resellers

24.1 Service Vendor might be: a) the Service provider; or b) Reseller, either member of Clock Group or other entity (Independent Reseller).

24.2 These service Terms shall be binding upon any Reseller.

24.3 Whoever the Service Vendor is, Klok AD shall always be the Service Provider and shall bear the service provider responsibilities.

24.4 When Affiliation Agreement is terminated the Affiliated Hotel may require discharge of the provider's obligations under Part V directly from Klok AD.

24.5 No Service vendor shall host, process or otherwise have access to the Affiliated Hotel's data unless the Affiliated hotel has authorised such Service vendor and granted them access to the system.

25. Where an Independent Reseller provides implementation, support, consultancy or other services which require access to the Affiliated Hotel's data, it does so under a separate agreement concluded between the Independent Reseller and the Affiliated Hotel, under which the Affiliated Hotel is the data Controller and the Independent Reseller is the data processor. If Klok AD is not a party to that agreement, Klok AD shall not be responsible for the Independent Reseller's processing. under it. Access by an Independent Reseller to the Affiliated Hotel's data through the Service shall be granted and maintained by the Affiliated Hotel. Klok AD shall not be responsible and liable for any breach or data loss resulting from such agreement.

26.1 Clock may at any time terminate the appointment of a Reseller. Where the appointment of a reseller is terminated, or where a reseller ceases to make the Service available to an Affiliated Hotel, Clock shall notify the Affiliated Hotel that the Service will be made available thereafter by Clock directly, by a Group Reseller or by another Independent Reseller.

26.2 Clock shall give not less than three months' notice of such a change where it is practicable to do so, and in any event as much notice as the circumstances permit. Clock shall make its best efforts to keep the Affiliated Hotel's rights unaffected and maintain the continuity of the Service.

26.3 Where the change of the Reseller requires the Affiliated Hotel to conclude commercial terms with another Reseller, the Affiliated Hotel may instead terminate the Affiliation Agreement with effect from the date of the change, without any penalties, cancellation fees, amounts in respect of the recovery of discounts or early termination compensations whatsoever. Clauses 15 – 19 and sub-clauses 20.1, - 20.2 shall apply accordingly.

VIII. New versions of Service terms

27.1 Clock may introduce new versions of these Service Terms. Clock shall publish the new version together with a summary of changes and notify the Affiliated Hotel at its official email addresses stated in the Affiliation Agreement; the new version states a definite effective date, no earlier than one month of the notification.

27.2 Before the effective date the Affiliated Hotel may object in writing, in which case the parties engage in good faith discussions and, failing agreement, the Affiliated Hotel may terminate the Agreement with effect no later than the effective date, free of any compensation, penalty, cancellation fee and, early termination compensations. Clauses 15 – 19 and sub-clauses 20.1 – 20.2 shall apply accordingly.

27.3 Where the Affiliated Hotel does not object, or continues to use the Service after the effective date, the new version shall be thus accepted.

IX. Law and jurisdiction

28.1 These Service Terms and the Affiliation Agreements shall be governed by Bulgarian law,.

28.2 The parties shall seek to resolve disputes in an amicable manner. If no such settlement is reached, the courts at the registered seat of Klok AD shall have exclusive jurisdiction over any dispute arising out of or in connection with them, including any non-contractual dispute.

28.3 These Service Terms and their Addendums are drawn up in English. Where Clock makes a version in another language available, it is provided for convenience only, and in the event of any discrepancy the English version shall prevail.

X. Transitional provisions: Substitution of the Service Vendor

29. Release of Clock Software

29.1 With effect from 1 January 2027 (the "Substitution Date"), the authorization of Clock Software as Service Vendor shall be terminated. Accordingly, as from the Substitution Date Clock Software shall be deprived from exercising any rights and from performing any duties having arisen out or related to each and any Affiliation Agreement Clock Software has entered into, with the exception of the collection of amounts that have become due prior to the Substitution Date.

29.2 As from the Substitution Date all rights and obligations of Clock Software having arisen out or related to each and any Affiliation Agreement shall be transferred to Klok, the latter being the current and the future Service Provider. For avoidance of any doubt, each and every Affiliation Agreement shall remain into force between the respective Affiliated Hotel and Klok on the same terms, with no alterations whatsoever, and there shall be no interruption in provision of the Service. Accordingly, as from the Substitution date all invoices shall be issued by Klok.

29.3 The above substitution shall be notified to each Affiliated Hotel by Klok and Clock Software in writing, three months prior to the Substitution Date. The Affiliated Hotel shall be entitled to terminate the Affiliation Agreement in one month of the notification, by a termination notice in writing to Clock Software.

30. Payment arrangements

30.1 With effect from the Substitution Date, any and all amounts falling due under an Affiliation Agreement shall be payable to and collected by Klok AD.

30.2 The Affiliated Hotel shall authorise Klok AD to request and to effect the transfer from Clock Software to Klok of every direct debit mandate, card authorisation, standing payment instruction and stored payment credential granted by the Affiliated Hotel in connection with the Affiliation Agreement, and shall grant consent to any payment service provider or payment scheme to comply with that authorisation. The Affiliated Hotel shall at first request confirm the authorization to any payment service provider or payment scheme, in the form required by the respective provider or scheme.

30.3 Where transfer under sub-clause 30.2 is effected, the mandate, authorisation, instruction or credential remain active in favour of Klok AD without interruption. The Affiliated Hotel shall not be required to provide new payment details.

30.4 If a payment service provider or payment scheme does not permit the transfer, or requires a new mandate or authorisation to be granted, Klok AD shall notify the Affiliated Hotel and the Affiliated Hotel shall put the replacement in place promptly, and in any event within 5 days of that notification, at no costs for the Affiliated hotel.

30.5 Klok AD may give that notification, and the replacement may be put in place, before the Substitution Date, so that collection continues without interruption from that date. If a replacement in favour of Klok AD is put in place before the Substitution Date, the existing payment method in favour of Clock Software and the replacement payment method in favour of Klok AD might be existing side by side until the Substitution Date and the following applies:

a) every amount due shall be collected once only, via one payment method, and in no event a duplicate collection of the same amount shall be effected;

b) until the Substitution Date, collections shall be made only via the payment method in favour of Clock Software;

c) as from the Substitution Date, collections shall be made only via the payment method in favour of Klok AD; the Payment method in favour of Clock Software shall be cancelled and shall not be used for any further collections, save the finalization of a collection initiated before the Substitution Date.

31. Value added tax (VAT)

31.1 The substitution under clause 29 changes the place of business of the Service Vendor from the United Kingdom to Bulgaria. It does not lead to any change of the net fees for the Service (the "Fees").

31.2 Although the Fees remain unchanged the substitution may lead to changing the VAT as from the Substitution date. The substitution may lead to the following:

a) no VAT will be invoiced to an Affiliated Hotel established in the United Kingdom;

b) a Bulgarian VAT shall be invoiced to an Affiliated Hotel established in Bulgaria;

c) the Service shall become an intra-Community supply to an Affiliated Hotel established elsewhere in the European Union, and the EU reverse VAT charge mechanism will apply;

d) an Affiliated Hotel established outside the European Union and the United Kingdom shall not be affected.

31.3 Each Affiliated Hotel remains responsible for its own VAT position and treatment, and the provisions of the respective Affiliation Agreement concerning taxation shall remain unaffected.

ADDENDUM 1

Personal Data Processing

To the Clock Service Terms, version 5.0

Version 2.0

Effective date 28 September 2026

Previous version: 24 June 2026

1. General

1.1 This Addendum 1 to the Service Terms applies to the processing of the personal data disclosed by and/or made available to the Affiliated Hotel in the course of usage of the Service.

1.2 For the purpose of the personal data processing Klok AD acts as a Data processor and the Affiliated Hotel acts as a data controller.

1.3 Where an Affiliated Hotel's Service account is provided as a part of a Subscription controlled by a group of hotels, the Affiliated Hotel and that group are joint controllers in respect of data shared across Service accounts within that Subscription.

1.4 Klok AD processes personal data for the following purposes:

1. provision and operation of the Service;
2. reservation and hospitality management;
3. guest journey and guest communication services;
4. payment processing and related financial operations;
5. customer support;
6. system administration, security, maintenance and monitoring;
7. reporting and analytics;
8. execution of integrations activated by the Customer;
9. compliance with legal obligations.

The categories of data subjects, categories of personal data and processing activities are further described in Schedule A.

1.5 The Affiliated hotel authorizes Klok AD to process personal data necessary to provide, maintain, secure, support and improve the Service.

1.6 If Klok AD is required by applicable law to process personal data other than the one described in this Addendum, Klok AD shall inform the Affiliated hotel, unless prohibited by law.

1.7 If Klok AD considers that any instruction given by the Affiliated hotel infringes any applicable law, Klok AD shall inform the Affiliated hotel without delay and may suspend the execution of that instruction.

2. Integrations activated by the affiliated hotel

2.1 The Service may enable the Affiliated Hotel to activate integrations with third-party systems and services. In such an event Klok AD shall provide information regarding the categories of data exchanged with such third-party systems before activation of the integration.

2.2 By activating such an integration, the Affiliated Hotel authorizes and requests Klok AD to exchange the data required for the operation of the selected integration in accordance with the functionality of the Service.

2.3 Third-party systems selected and activated by the Affiliated Hotel are not considered sub-processors appointed by Klok AD unless expressly admitted by Klok AD.

2.4 The Affiliated Hotel remains responsible for assessing the suitability and compliance of any third-party system selected by the Customer.

3. Confidentiality

3.1 Klok AD shall ensure that personnel authorized to process Personal Data:

1. are subject to appropriate confidentiality obligations;
2. receive appropriate security and privacy training;
3. access Personal Data only where necessary for their duties.

3.2 Klok AD shall ensure that access to personal data is limited in accordance with the principles of least privilege and business need-to-know.

4. Security of processing

4.1 Klok AD shall implement and maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. The measures implemented by Klok AD are described in Schedule B.

4.2 Klok AD may update such measures from time to time provided that the overall level of protection is not materially reduced.

4.3 The Affiliated Hotel acknowledges that the Service includes configurable security settings, access controls and user permission structures and that Affiliated Hotel is responsible for configuring and using such controls appropriately.

5. Assistance to Affiliated hotel

5.1 Taking into account the nature of the processing and the information available to Klok AD, Klok AD shall provide reasonable assistance to Customer in fulfilling the Affiliated Hotel’s obligations relating to:

1. requests from data subjects;
2. security of processing;
3. personal data breach notifications;
4. data protection impact assessments;
5. consultations with supervisory authorities where required by law.

Such assistance shall be limited to information and functionality available to Klok AD within the ordinary operation of the Service and shall not require Klok AD to develop custom functionality, provide legal advice, perform legal analysis on behalf of the Affiliated Hotel or materially modify the Service.

Where a data subject submits a request directly to Klok AD, Klok AD shall not respond to the substance of the request save as instructed by the Affiliated Hotel, shall direct the data subject to the Affiliated Hotel and shall inform the Affiliated Hotel about the request without undue delay.

6. Personal data breaches

Klok AD shall notify the Affiliated Hotel without undue delay after becoming aware of a personal data breach affecting the Affiliated Hotel’ personal data. Such notification shall include available information reasonably necessary for the Affiliated Hotel to comply with its obligations under the applicable laws.

7. Sub-processors

7.1 The Affiliated Hotel provides a general authorization for Klok AD to engage sub-processors as necessary for the provision, maintenance, security and support of the Service.

7.2 Klok AD shall maintain an up-to-date list of sub-processors in Schedule C, published at the address stated in that Schedule.

7.3 Klok AD shall inform the Affiliated Hotel of any intended addition or replacement of a Subprocessor not less than 30 days before that Subprocessor begins processing the Affiliated Hotel’s personal data, by publication of the updated Schedule C and by notice to the Affiliated Hotel.

7.4 The Affiliated Hotel may object to an intended addition or replacement, on reasonable grounds relating to the protection of personal data, within 30 days of that notice. In such an event the parties shall discuss the objection in good faith. Where no solution is reached, the Affiliated Hotel may terminate the affected part of the Service on written notice, without compensation, penalty, cancellation fee or early termination amount of any kind, and without any amount being payable in respect of the recovery of discounts.

7.5 Klok AD shall enter into a written agreement with each sub-processor imposing data protection obligations providing a level of protection for personal data equivalent to those set out in this Addendum, and remain fully liable to the Affiliated Hotel for the performance of each sub-processor's obligations.

Where a sub-processor is engaged as an urgent measure to preserve the security or continuity of the Service, Klok AD may engage it immediately and shall inform the Affiliated Hotel without undue delay thereafter, whereupon the objection right above applies.

8. International transfers

8.1 The location of hosting and processing is stated in the Service Terms. No hosting, storage or backup of the Affiliated Hotel ‘s personal data takes place outside the European Economic Area.

8.2 Personal data may be accessed from outside the European Economic Area only in the following circumstances:

1. where a sub-processor provides support, maintenance, operational or security services from a location outside the European Economic Area;
2. where the transfer results from a third-party integration or service activated by the Affiliated Hotel, in which case the transfer is made upon the Affiliated Hotel 's instruction and the Affiliated Hotel is responsible for the arrangements governing it;
3. where necessary for the provision of the Service and permitted under applicable laws; or
4. where required by applicable law

8.3 Where any such access constitutes a transfer of personal data to a third country Klok AD shall implement an appropriate transfer mechanism, together with any supplementary measures required.

9. Compliance information and audit

9.1 Upon reasonable written request by the Affiliated Hotel, Klok AD shall make available information reasonably necessary to demonstrate compliance with this Addendum and applicable laws. Klok AD may satisfy such requests through the provision of policies, procedures, security documentation, compliance questionnaires or similar materials.

9.2 Any such requests must be proportionate, limited in scope and not require disclosure of confidential information relating to other customers, Klok AD's security architecture or trade secrets.

9.3 Where the information made available under this clause is insufficient to demonstrate compliance, the Affiliated Hotel, or an independent auditor authorized by the Affiliated Hotel and not being a competitor of Klok AD, may conduct an audit of Klok AD's processing.

9.4 Any such audit shall be conducted on not less than 30 days' written notice, no more than once in any 12-month period save where required by a supervisory authority or following a personal data breach affecting the Affiliated Hotel’s Personal Data, during normal business hours, subject to reasonable confidentiality undertakings, and in a manner which does not disrupt the Service or compromise the security or confidentiality of the data of other customers.

Klok AD may charge its reasonable costs of supporting an inspection at its standard hourly rates, save where the audit reveals a material failure by Klok AD to comply with this Addendum.

10. Retention

Klok AD may retain personal data where required by law or for legitimate backup, archival, fraud prevention, security or compliance purposes, and shall not use such data for any other purpose.

11. Artificial intelligence

11.1 Klok AD shall not use the Affiliated Hotel’s personal data to train publicly available or general-purpose artificial intelligence or machine learning models unless expressly authorized by the Affiliated Hotel.

11.2 Any third-party artificial intelligence service engaged by Klok AD in connection with the Service shall be treated as a Sub-processor where required by Applicable Data Protection Laws.

SCHEDULE A – Description of processing activities

Unchanged from the version effective 24 June 2026.

A.1 Data subjects

Klok AD may process personal data relating to:

1. hotel guests;
2. prospective guests;
3. event attendees;
4. loyalty programme participants;
5. authorized users of the Service;
6. representatives of corporate customers, event organizers and business contacts managed through the Service;
7. individuals communicating with the Affiliated Hotel through the Service.

A.2 Categories of personal data

Identification Data — names; titles; nationality; date of birth; identification document details where entered by the Affiliated Hotel.

Contact Details — email addresses; telephone numbers; postal addresses; company information.

Reservation and Stay Data — reservation details; arrival and departure information; room assignments; accommodation history; preferences; special requests; guest profile information.

Event and Activity Data — event participation details; meeting and event bookings; activity bookings; attendance records.

Communication Data — guest communications; email correspondence; support communications; notes entered by the Affiliated Hotel personnel.

Financial and Payment Data — invoices; transaction records; payment status information; payment tokens; masked payment card information where applicable.

Klok AD does not intentionally store sensitive authentication data as defined by PCI DSS.

Loyalty and Marketing Data — loyalty programme participation; membership identifiers; customer preferences; communication preferences.

Support and Technical Data — user account information; audit logs; support records; system usage information.

SCHEDULE B – Technical and organisational measures

Unchanged from the version effective 24 June 2026.

B.1 Governance and Security Management

B.1.1 Klok AD maintains documented information security policies and procedures.

B.1.2 Klok AD designates personnel with responsibility for information security governance and oversight. Information security policies are reviewed periodically and updated where appropriate. Personnel receive security awareness and privacy training relevant to their responsibilities.

B.2 Access Controls

B.2.1 Klok AD implements access controls designed to ensure that access to Personal Data is granted only where required for legitimate business purposes. Measures include role-based access controls; unique user credentials; password controls; privileged access management; periodic access reviews; and access restrictions based on business need-to-know principles.

B.2.2 Multi-factor authentication is required for personnel accessing sensitive payment-related environments and may be made available or recommended for other categories of users.

B.3 Encryption and Protection of Data

Measures include encryption of data transmitted over public networks; encryption of sensitive removable media where used; protection of payment-related information in accordance with PCI DSS requirements; and protection of cryptographic keys and authentication credentials.

B.4 Network and Infrastructure Security

Measures include network segmentation where appropriate; firewall protections; secure remote access controls; monitoring of network activity; and security hardening of production environments.

B.5 Monitoring and Vulnerability Management

Measures include audit logging; system monitoring; security alerting; vulnerability monitoring; patch management processes; and investigation and response procedures for security incidents.

B.6 Secure Development Practices

Measures include secure software development lifecycle procedures; code review processes; testing prior to production release; change management procedures; and post-deployment review processes.

B.7 Business Continuity and Recovery

Measures include backup procedures; protection of backup media; disaster recovery procedures; and restoration and recovery processes.

B.8 Personnel Security

Personnel with access to Personal Data are subject to confidentiality obligations and are required to follow Klok AD's security policies and procedures. Access rights are removed or adjusted when no longer required for business purposes.

SCHEDULE C – Sub-processors

Klok AD may engage the following Sub-processors:

Klok AD may update this Annex from time to time in accordance with section 11. The version published at https://www.clock-software.com/data-processing-agreement constitutes the current version of Annex C.

SCHEDULE D – United States Privacy Laws

D.1 Application. This Annex applies where and to the extent that Klok AD processes personal data on behalf of the Affiliated Hotel which is subject to the privacy laws of a State of the United States, including the California Consumer Privacy Act as amended ("CCPA") and the comprehensive privacy statutes of other States. Terms used in this Addendum have the meanings given to them in the applicable State law.

D.2 Roles. The Affiliated Hotel is the Business or Controller and Klok AD is the Service Provider, within the meaning under the applicable State law. Klok AD does not sell or share personal data, and does not retain, use or disclose it for any purpose other than performing the Service specified in the Service Terms and this Addendum, or as otherwise permitted by the applicable State law.

D.3 Restrictions. Klok AD shall not:

a) sell or share personal data;

b) retain, use or disclose Personal Data outside the direct business relationship between Klok AD and the Affiliated Hotel; c) retain, use or disclose personal data for any purpose other than the business purposes specified in the Service Terms and this Addendum, including for any commercial purpose of its own; or d) combine Personal Data received from or on behalf of the Affiliated Hotel with Personal Data received from or on behalf of any other person, except as permitted by the applicable State law.

D.4 Warranty. Klok AD warrants that it understands the restrictions in paragraph D.3 and will comply with them.

D.5 Assistance. Klok AD shall assist the Affiliated Hotel in responding to consumer requests to know, delete, correct, opt out and limit the use of sensitive personal information, to the extent of the functionality available within the Service. .

D.6 Subcontracting. Klok AD shall impose the obligations in this Addendum on each Sub-processor engaged in processing personal data subject to a State privacy law.

D.7 Notification. Klok AD shall notify the Affiliated Hotel without undue delay where it determines that it can no longer meet its obligations under the applicable State law.

D.8 Monitoring. The Affiliated Hotel may take reasonable and appropriate steps to confirm that Klok AD uses Personal Data in a manner consistent with the Affiliated Hotel 's obligations under the applicable State law, through the compliance information and audit provisions at clause 9 of this Addendum.

D.9 Employee and business contact data. The Affiliated Hotel acknowledges that where the CCPA applies, it extends to personal data relating to the Affiliated Hotel’s 's own personnel and to business contacts held within the Service, and not only to personal data relating to guests.

Addendum 2

Data Portability

To the Clock Service Terms, version 5.0

Effective 28 September 2026

1. General

1.1. This Addendum 2 to the Service Terms is made pursuant to Article 25(2)(e) and (f) of Regulation (EU) 2023/2854..

1.2. This Addendum specifies the categories of exportable data and digital assets, and the categories excluded from export. The contents of each category — the resources, endpoints, field names, types, permitted values and relationships — are published and maintained at https://api-docs.clock-software.com

1.3. Clock may extend the scope of the exportable data at any time without notice, by including:

1. new categories in this Addendum; or
2. new resources or fields in the published documentation.

1.4 Clock’s policy and practice is not to remove categories of exportable data from the interfaces, but rather to add new categories. Despite this, a removal might from time to time become necessary. In such an event the categories of data to be removed shall be published at Clock’s website prior to removal.

2. Means of export

2.1. The Affiliated Hotel may export its data by the means described in this clause, at any time during the Service term, including the notice period, the transitional period and the Data Retrieval Period described in the Service Terms. No fees shall be charged for retrieval, export or transfer of the data.

2.2. Application programming interfaces. A set of REST interfaces returning structured, commonly used and machine-readable data. Authentication, available resources, data structures, formats and reference examples are documented at https://api-docs.clock-software.com.

The interfaces provide access to the complete set of the Affiliated Hotel's exportable data described at clause 3.

Access is available to the Affiliated Hotel and to any third party it appoints, including a provider of a competing service acting on its behalfRequests are subject to the rate limits published in the API documentation, applied uniformly to all Affiliated Hotels. The limits applied to an extraction performed for switching purposes are the same as those applied in ordinary production use.

2.3. Service interface. Reports, data sets and generated documents exportable directly from the Service interface in CSV, XLSX or PDF as applicable, including the bulk export of fiscal documents described at section 4 of this Annex.

2.4. Activation. Neither means is necessarily active on a Service account by default. Where the Affiliated Hotel wishes to use one which is not active, Clock activates it upon request and without charge. API credentials are issued within two working days of the request.

3. Categories of exportable data

3.1. The specification. The exhaustive specification of the categories of exportable data required by Article 25(2)(e) of Regulation (EU) 2023/2854 is the published technical documentation of the Clock application programming interfaces at https://api-docs.clock-software.com, together with the supplementary documentation at https://developers.clock-software.com.

Every category of data exposed by those interfaces forms part of the Affiliated Hotel's exportable data, subject only to the exclusions set in clause 7 of this Annex. The documentation produced by Clock is publicly accessible without registration, and may be inspected by the Affiliated Hotel and by any third party it appoints, at any time and before conclusion of an Affiliation Agreement.

3.2. Principal categories. The principal categories are identified below for orientation. This list does not limit the preceding paragraph, and a category is not excluded from the exportable data by reason of not appearing in it.

1. Reservations
2. Guest profiles
3. Companies and agents
4. Rooms and room types
5. Rates and rate definitions
6. Folios and charges
7. Point of sale orders
8. Prices and availability

3.3. Configuration. Data created by the Affiliated Hotel in configuring the Service forms part of its exportable data. Configuration reflects the way the Service is structured and will not ordinarily be directly importable into another system without transformation; that does not affect its exportability, and mapping onto a destination system is addressed at section 5 of this Annex.

The manner in which Clock represents configuration internally — the derivation structures of the rate engine, internal flags, system defaults, and the logic by which configured values are applied, including occupancy-adaptive pricing — is specific to the internal functioning of the Service and is excluded under section 7 of this Annex. What is exportable is the configuration as the Affiliated Hotel entered it, not the mechanism by which the Service gives effect to it.

3.4. Guest communications. Email communications to guests are dispatched through the Affiliated Hotel's own email infrastructure and under its own sending domain. Copies therefore reside in the Affiliated Hotel's own mail systems and are not held by Clock as a separate exportable category. Records of the reservations, guests and events to which such communications relate are exported within the categories at section 3.

3.5. Housekeeping. Housekeeping task and attendant records are working data with effect for the day to which they relate and are not maintained by Clock as a historical record. There is accordingly nothing retained to export. Room and reservation status, and the movements from which housekeeping activity derives, are exported within the Reservations category.

3.6. Data ported at onboarding. All data provided by or on behalf of the Affiliated Hotel at the commencement of the Service forms part of its exportable data and is exportable on the same terms as data created through use of the Service.

Clock does not import historical financial or transactional records from a previous system. Fiscal regimes in a number of jurisdictions require the immutability of financial records and do not permit past charges, revenue or fiscal documents to be loaded into a new system. What is migrated at onboarding is accordingly limited to reservations with an arrival date falling after the migration, and the Affiliated Hotel's guest profiles. Both are exportable in full.

4. Digital assets

4.1. The digital assets of an Affiliated Hotel include:

1. fiscal documents — invoices, credit notes and debit notes, in PDF, in the form in which they were issued;
2. other generated documents — folio statements, booking confirmations, registration cards and other guest-facing documents generated by the Service, in PDF;
3. files uploaded by the Affiliated Hotel to the Service, in the format in which they were uploaded; and
4. document and email templates configured by the Affiliated Hotel.

4.2. Bulk export of fiscal documents. The documents at paragraph a) are exportable in bulk in PDF, in the form in which they were issued. This facility exists so that an Affiliated Hotel subject to record retention obligations which require fiscal documents to be retained as issued, rather than reconstructed from underlying data, is able to retrieve and archive them independently of continued access to the Service.

The facility is available throughout the Service term and throughout the notice period, the transitional period and the Data Retrieval Period. It ceases upon expiry of the data retrieval period, when the Service account is closed and the Retention Period begins. Thereafter the documents are retrievable only under one of the services described in the Service Terms as available during the Retention Period.

4.3. Other assets. The documents and files under items ( b) to (d) of sub-clause 4.1 are retrievable through the Service interface. They are not exportable in bulk.

4.4. Underlying data. The data from which generated documents are produced is exportable in full through the interfaces listed in clause 2, including folio and charge records, document numbering and dates, tax treatment, values, and the guest and company details appearing on each document.

4.5. Statutory retention. The Affiliated Hotel is responsible for complying with its own record retention obligations and for retrieving and archiving its documents accordingly. Where those obligations extend beyond the periods described in the Service Terms, the Affiliated Hotel should retrieve its documents during the Service term or during the data retrieval period.

5. Relationships and referential integrity

5.1. The exported data preserves the relationships between categories by means of stable numeric identifiers. Each record carries the identifier of the account to which it belongs, and records reference one another by identifier rather than by name. Identifiers are unique across the Clock platform and stable over the life of the record, so relationships remain resolvable after export.

5.2. Where a record carries both an identifier and a denormalised name, both are exported, so that the export remains interpretable even where the referenced record has since been amended.

5.3. The relationships between resources, and the identifiers by which they are expressed, are documented at https://api-docs.clock-software.com.

5.4. Clock does not warrant that a receiving system will accept these relationships without transformation. Mapping the exported structure onto a destination system is the responsibility of the Affiliated Hotel or of the provider it appoints, and Clock's obligation is the provision of the access, documentation, information and technical responses described in the Service Terms.

6. Formats

Values are expressed in the units documented for each field. Monetary values are expressed in minor units as integers with a separate ISO 4217 currency code. Dates are expressed as YYYY-MM-DD and timestamps in UTC.

7. Categories excluded from export

The following are excluded under Article 25(2)(f) of Regulation (EU) 2023/2854 as specific to the internal functioning of the Service: .

1. Internal application data. Source code, database schemas beyond those published, internal identifiers not exposed through the API, application logs, infrastructure configuration, monitoring and telemetry data, and the internal structures and logic by which the Service operates, including the derivation and occupancy-adaptive pricing mechanisms described at section 3.6.

2. Aggregated and anonymised statistics. Statistics derived across multiple Affiliated Hotels for the purpose of operating and improving the Service, which do not identify the Affiliated Hotel or its guests.

3. Payment credentials. Card numbers, card verification values and payment tokens held under the payment service provider's tokenisation scheme. These are excluded because they are held by the payment service provider under the applicable payment scheme rules and card industry standards, not by Clock, and cannot lawfully be released to the Affiliated Hotel or to a third party. Transaction records, amounts, currencies, methods, timestamps and payment references are exportable in full within the Payments category.

4. Third-party data. Data belonging to another Affiliated Hotel within the same Service subscription, and data belonging to a third-party integration provider which is held in the Service under that provider's own arrangements. The treatment of shared data within a Group subscription is governed by the Service Terms.

5. Clock's own records. Clock's records concerning the commercial relationship with the Affiliated Hotel, including support tickets, billing records and correspondence, which are not data processed through the Service. These are available to the Affiliated Hotel on request through its account manager, but do not form part of the exportable data.

6. No exclusion on trade secret grounds. Clock claims no exclusion under Article 25(2)(f) on grounds of trade secret in respect of any category of the Affiliated Hotel's data. The data structures, resources, field names and types are published openly at https://api-docs.clock-software.com, so no confidentiality attaches to them. The exclusions at sections 7.1 to 7.5 concern the internal functioning of the Service, the data of third parties, and credentials which Clock does not hold — not the Affiliated Hotel's own data.

7.2 None of these above impedes or delays the switching process, and none concerns data provided by the Affiliated Hotel or generated by its use of the Service.

8. Shared data in Group subscriptions

Where the Affiliated Hotel's Service account is provisioned within a subscription controlled by a Group, the provisions of the Service Terms concerning group structures and shared data apply. In summary:

13. the Affiliated Hotel's rights are not conditional on the Group's consent or non-objection;
guest profiles, company profiles, user accounts, revenue groups and revenue categories are shared across accounts within the subscription;
15. where a shared record relates to more than one Affiliated Hotel, the Affiliated Hotel may export the record together with the transactions attributable to its own account;
transactions attributable exclusively to other Affiliated Hotels are not part of its exportable data.

9. Updates of this Addendum

9.1. Clock may from time to time update this Addendum where the categories of exportable data change. Changes shall be notified in accordance with the Service Terms.

9.2. Where a new category of data is created through the Affiliated Hotel's use of the Service, it forms part of the exportable data, regardless of whether this Addendum has yet been updated or not.