Terms and Conditions for Golf Facilities

These general terms and conditions (the "Terms and Conditions for Golf Facilities") constitute an appendix to the Main Agreement entered into between the Facility and Sweetspot and constitute an integrated part thereof, and all definitions defined therein shall also apply to these Terms and Conditions for Golf Facilities.

Background

(A) Sweetspot offers mobile- and/or web-based platforms for golf related digital services.

(B) The Facility conducts golf activities and offer golfers the opportunity to play and/or practice golf on its/their facility/facilities. The Facility's members (the "Members") and other players ("Guests") and by the Facility authorized companies (the "Company Customers"), may through the Service inter alia book time slots to make use of the Facility's facility/facilities ("Booking"), pay membership fees and rent, or purchase equipment. Members, Guests and Company Customers are hereinafter collectively referred to as "Users".

(C) The Parties desires to enter into this cooperation in order to improve the Facility's work for the Users by using the Service in accordance with the terms and conditions of the Main Agreement and its appendices.

1. The Service

Sweetspot provides the "Service" which comprise:

(i) a mobile- and/or web-based application which enable Users to book and use services provided by the Facility (the "Application");

(ii) the Facility web-based user interface for the handling of inter alia, Members, Bookings, statistics etc. (the "Platform"); and

(iii) handling of Users' payment of fees (e.g., green fees, membership fees and rental costs) through a payment service linked to the Application (the "Payment Service").

2. Term and Termination

In addition to the Main Agreement the following applies in relation Term and Termination.

2.1 Sweetspot has the right to terminate the Main Agreement with immediate effect if:

(i) the Facility does not pay the Monthly Fee or Transaction Fee on time and such breach is not remedied within five days of receiving notice from Sweetspot of the non-payment; and

(ii) the Facility is in breach of any of its undertakings in clauses 3, 4 and 7 of these Terms and Conditions for Golf Facilities and such breach is not remedied within five days of receiving notice to that effect.

2.2 Each Party has the right to terminate the Main Agreement with immediate effect if:

(i) the other Party commits any other material breach of the Main Agreement and such breach is not remedied within five days of receiving notice to that effect; or

(ii) the other Party has been placed into liquidation or proceedings has been initiated for bankruptcy, corporate reorganization (Sw. företagsrekonstruktion) or the other Party is otherwise insolvent.

2.3 Termination in accordance with clauses in the Main Agreement and 2.1 - 2.2 shall be made in writing.

2.4 Upon termination of the Main Agreement, the Facility has upon written request to Sweetspot the right to, within 90 days, obtain the raw data (Sw. rådata) regarding the Facility and its Users which has been made available to Sweetspot through the Service.

2.5 Notwithstanding what is stated under clause 2.4, the Facility shall upon termination of the Main Agreement in its entirely return to Sweetspot all intellectual property rights, and other data that may be provided to the Facility or otherwise made available to the Facility through the Service, in accordance with clause 7 below.

2.7 After three years from the date of the Main Agreement, each Party may by a written notice to the other Party call for a renegotiation of the Main Agreement. The Parties shall in such case in good faith discuss and negotiate and use their commercially best efforts in trying to agree on a new agreement. Should the Parties fail to conclude a new agreement, this Main Agreement shall continue to apply until terminated in accordance with its terms. For the sake of clarity, each Party's obligations under this Main Agreement shall continue to apply until a new agreement has been concluded and each Party shall be liable for any breaches of the Main Agreement committed during such renegotiation period.

3. The Facility's Undertakings

3.1 The Facility undertakes to:

(i) provide to Sweetspot the general terms and conditions and/or booking rules for the Users;

(ii) provide to Sweetspot any updates or amendments to its general terms and conditions (noting for the avoidance of doubt that any updates or amendments will not be effective towards the User until they have been published on the Application/Platform (as applicable));

(iii) offer booked time slots to Users in accordance with made Bookings;

(iv) offer to the Users such products/services which are rented by Users or booked through the Service; and

(v) provide Sweetspot access to the Facility's API-keys (application programming interface) to enable Sweetspot's provision of the Service and development of additional functions of the Service.

3.2 The Parties note that Sweetspot act as a service provider to the Facility and that the Facility shall be the contractual party responsible for fulfilling all contractual obligations towards the Users (including but not limited to providing Tee Times, products or services and the handling of refunds, cancellations and potential disputes) (the "User Obligations") in accordance with Sweetspot's terms and conditions for Users, as applicable from time to time.

3.3 The Facility shall indemnify and hold harmless Sweetspot from any claims, fines and costs due to:

(i) Sweetspots fulfillment of any User Obligations; or

(ii) any other obligations arising due to the Facility’s non-fulfilment of the User Obligations, negligence or misconduct.

4. The Payment service by Adyen

4.1 In order for the Facility to be able to use the Payment Service provided by Adyen N.V., the Facility:

(i) undertakes to provide all such know-your-customer (KYC) and anti-money laundering documentation and information as requested by Sweetspot or Adyen N.V., from time to time;

(ii) acknowledges and authorizes Sweetspot to act as a representative of the Facility and to take any actions deemed necessary or prudent with respect to the Facility's onboarding and subsequent use of the Payment Service.

(iii) undertakes to enter into a separate agreement with Adyen N.V., as required, from time to time;

(iv) undertakes to comply with PCI DSS and other applicable rules and regulations and any instructions or documentation issued by Adyen N.V. in relation to ordering, storage and return of payment terminals; and

(v) undertakes to comply with applicable laws, bylaws, rules, regulations, operating regulations and procedures issued by the specific payment method providers (e.g. Visa and MasterCard), as applicable from time to time and available on the websites of the payment respective method providers (the "Scheme Rules").

4.2 The Facility shall indemnify and hold harmless Sweetspot for all claims, fines and costs arising from:

(i) any claims by Adyen N.V. (including but not limited to chargebacks and refunds as well as deposits where the Facility fails to pay)

(ii) any non-compliance by the Facility of PCI DSS and other applicable rules and regulations and any instructions or documentation received by Sweetspot or Adyen N.V.; and

(iii) any non-compliance by the Facility of applicable laws or the Scheme Rules.

4.3 Sweetspot's provision and the Facilities use of the Service require that Sweetspot hold a license to Extenda Retail AS' software. The Facility acknowledges and agrees that its use of the Service is subject to the Facility at all times complying with Extenda Retail AS’ terms and conditions, applicable from time to time ( current terms and conditions are accessible at www.extendago.com/terms/ ). Sweetspot makes no warranty, either express or implied, including without limitation any implied warranty of merchantability or fitness for a particular purpose, and provides no warranties for modifications or integrations to the Extenda Retail software not made by Sweetspot or Extenda Retail, or which is due to the Facility's use of the software in a manner inconsistent with applicable documentation or Extenda Retails' terms and conditions.

5. The Subscription Fee, Fees and invoicing

5.1 The Facility shall pay the Monthly Fee upon invoice in advance to Sweetspot. The Monthly Fee is set forth in Appendix 1.

5.2 Sweetspot shall receive the Transaction Fee, based on the percentage stated in Appendix 1, in relation to the fees paid by or refunded to Users through the Payment Service (the "Transaction Fee").

5.3 The Transaction Fee shall be based on all transactions made by or to Users through the Payment Service, regardless of e.g., any complaint or canceled Bookings etc ("Fees").

5.4 The Fees are paid to the Facility in accordance with clause 6 below, from which the Transaction Fee and any other costs that the Parties agree on are deducted.

6. Reporting and payment

6.1 Sweetspot shall:

(i) make available reporting for accounting purposes to the Facility.

(ii) on a minimum include the difference between the Transaction Fees and the Fees received.

6.2 Payments in accordance with clause 6.1 above shall be made in arrears no later than two calendar weeks following the current accounting period. In the event of late payment, the Facility has the right to charge interest on arrears in accordance with applicable law.

7. Intellectual property rights

7.1 Sweetspot or its licensors holds the proprietorship and all intellectual property rights to the Service, including all software and data contained therein, and no rights in this regard shall be transferred to the Facility under the Main Agreement. The Facility do not have the right to copy, transfer, license, provide or otherwise dispose of the Service or parts thereof, other than as stated in the Main Agreement.

7.2 Subject to compliance with these Terms and Conditions for Golf Facilities, Sweetspot grants the Facility a limited non-exclusive, non-sublicensable, non-transferable, revocable license to access and use the Service. All rights not expressly granted herein are reserved to Sweetspot and Sweetspot's licensors.

7.3 The Parties agree that the Facility owns the rights to all raw data directly attributable to the Facility and its Users generated during the Term or has otherwise been provided by the Facility to Sweetspot during the Term (such as customer registers, booking patterns and payment history) subject to such transfer of raw data from Sweetspot to the Facility being in compliance with Sweetspot's agreement with the Users, Sweetspot's privacy policy or mandatory law. The Parties also agree the Sweetspot has an extensive right to use the Facility data for compiling purposes and as otherwise deemed necessary to provide or develop the Service.

7.4 Notwithstanding what is otherwise permitted under these Terms and Conditions for Golf Facilities and which follows from mandatory law, the Facility undertakes not to:

(i) copy the Service, except when such copying takes place through normal use of the Platform;

(ii) rent, lease, sublicense, lend, translate, automatically read, merge, adapt, vary or modify the Platform, the Application or information obtained through the Service;

(iii) make changes or modifications to all or part of the Platform, the Application or information obtained through the Service, and not contribute to that any part of these are being combined with or incorporated into other programs;

(iv) disassemble, decompile, back-compile or create derivative works based on whole or part of the Platform or the Application and/or information obtained through the Service, and not attempt to perform any of the above, except to the extent that such actions cannot be prevented by mandatory law; and

(v) provide or otherwise make the Platform, the Application and/or information obtained through the Service available in whole or in part (including but not limited to program lists, lists of objects and source programs, object code and source code), in any form to a third party.

7.5 The Parties have the right to use each other's trademarks and other characteristics during the Term and in accordance with these Terms and Conditions for Golf Facilities to the extent required to fulfill their obligations under the Main Agreement.

8. Liability and limitations of liability

8.1 Sweetspot guarantees that the use of the Service does not infringe the intellectual property rights of any third parties.

8.2 Sweetspot does not guarantee that the Service is free from errors or interruptions and Sweetspot shall not be held liable for any downtime caused by any third party or the fact that the internet is not accessible. The Facility understands that freedom from software errors cannot be achieved in the software industry. The Service is provided to Users as is (Sw. befintligt skick) and Sweetspot makes no warranties of any kind with respect to the Service including its function, availability, quality, or fitness for purpose, other than as set forth in Appendix 2.

8.3 Any conditions implied as a matter of law as to the function, availability, quality or fitness for purpose of the Service are excluded from the Main Agreement to the fullest extent permitted at law.

8.4 Sweetspot's liability for damages according to these Terms and Conditions for Golf Facilities are limited to an amount corresponding to what the Facility paid in Transaction Fee to Sweetspot during the twelve-month period immediately preceding the time of damage, however, no more than an amount corresponding to two price base amounts (Sw. prisbasbelopp) at the time of damage. Sweetspot is not responsible in any case for loss of profit or any other consequential or indirect damage, or for loss of information.

9. Grounds for exemption (force majeure)

9.1 Sweetspot shall not be liable for loss, damage or delay due to circumstances caused by government action or omission, new or changed legislation, labour market conflict, acts of war, fire, blockade, epidemic, pandemic or other circumstance that Sweetspot could not reasonably be expected to have anticipated and whose consequences Sweetspot could not reasonably have avoided or overcome without undue delay (force majeure).

9.2 In the event of a force majeure event taking place Sweetspot shall notify the Facility in writing without delay.

9.3 If the completion of material parts of the Agreement has been delayed for more than three months due to a force-majeure event, the Facility may be entitled to terminate the Agreement.

10. Data processing

10.1 In order to provide the Service and fulfill its obligations to the Facility, Sweetspot must collect, process and to some extent store the Facility's company- and personal data and Users' personal data ("Data").

10.2 Sweetspot processes Data in accordance with the applicable data protection legislation in force at any given time, including the GDPR. Sweetspot's processing of the Data can be found in the privacy policy available on Sweetspot's website, https://sweetspot.io/terms . The policy describes which Data is collected and why, the legal basis for the processing of the Data, how the Data is protected, the rights of the Data subjects and how long the Data is stored.

10.3 The Facility and Sweetspot's processing of each other's Data is further regulated in clause 14.

11. Confidential information

11.1 The Facility undertakes not to disclose to third parties, confidential information or knowledge that the Facility has gained through the cooperation, and which may be regarded as trade secrets for Sweetspot. The Facility shall take the necessary measures to prevent such information from being disclosed to third parties by employees, users, advisors or third parties. The above applies unless the disclosure of information is subject to mandatory law or injunction from authority. The duty of confidentiality shall last during the Term and for a period of two years thereafter.

11.2 Confidential information refers to any information - technical, commercial or of any other kind, including but not limited to know-how and user data - regardless of whether the information is documented or not, with the exception of information which:

(i) at the date of its disclosure under the Main Agreement is public knowledge or which subsequently becomes public knowledge other than by reason of any breach of the Main Agreement;

(ii) is already known to the Facility (as evidenced by the Facility's written records) at the time of its disclosure but was not acquired by Sweetspot;

(iii) is at any time after its disclosure acquired by the Facility from any third party who was not in breach of any obligation of confidentiality;

12. Miscellaneous

12.1 The Main Agreement together with its appendices constitute the entire agreement between the Parties and supersede any prior written or oral agreement between the Parties regarding the subject matter of the Agreement.

12.2 The Facility does not have the right to transfer its rights or obligations under the Agreement without Sweetspot's prior written consent. Sweetspot has the right to transfer its rights and obligations under the Main Agreement to third parties.

12.3 Sweetspot has the right to adjust, change, make additions or expand the function of both the Service and the Subscription. Any other amendments and additions to this Agreement shall be in writing and signed by both Parties.

12.4 When the Main Agreement and its appendices state that the Party shall submit a notice in writing, this shall mean a document that reaches the other Party concerned by courier, registered mail or by email to the address or e-mail address stated in the Main Agreement. Any such notice or communication given or made to a Party will only be effective:

(i) if delivered by courier: at the time of delivery;

(ii) if sent by registered mail: two days after delivery by postal service; or

(ii) if sent by e-mail: the date of dispatch.

Change of address shall be notified to the other Party in the manner prescribed for in this clause.

13. Applicable law and dispute resolution

13.1 The Main Agreement shall be governed by Swedish law. Disputes that arise as a result of the Main Agreement shall be finally settled through arbitration proceedings administered by the Stockholm Chamber of Commerce's Arbitration Institute ("SCC"). Rules for Expedited Arbitration shall be applied unless the SCC, considering the severity of the case, the value of the subject matter of the dispute and other circumstances decides that Arbitration Rules shall be applied. In the latter case, the SCC shall also decide whether the arbitral tribunal shall consist of one or three arbitrators. The seat of the arbitration shall be Stockholm. The language of the procedure shall be English.

13.2 Arbitration proceedings called for with reference to this arbitration clause are covered by confidentiality. The confidentiality undertaking includes all information disclosed in the course of such arbitral proceedings, as well as any decision or award made or declared during the proceedings. A party shall however not be prevented from disclosing such information which the party is obligated to disclose pursuant to mandatory law, regulations, decisions of public authorities, listing agreement or similar

14. Data Processing Terms

These data processing terms (the "Data Processing Terms") have been entered into between:

1) The Facility (the "Controller"); and

2) Sweetspot (the "Processor").

Background

The Parties have entered into an Main Agreement in regard to Sweetspot AB's mobile- and/or web-based platforms for golf related digital services (the "Main Agreement").

Within the obligations arising from the Main Agreement, the Processor may process personal data and other information on behalf of the Controller.

Due to the above, the Controller accepts these Data Processing Terms below to regulate the conditions for the Processor's processing of, and access to, personal data belonging to the Controller in accordance with the Main Agreement. The Data Processing Terms consists of this document including Appendix A – processing of personal data.

The Controller is the data controller for the personal data processed within the framework of the Main Agreement. The Processor is to be regarded as the data processor for the Controller.

The Processor shall not receive any compensation for any action it takes regarding the processing of personal data in accordance with these Data Processing Terms.

14.1 Definitions

Definitions used in these Data Processing Terms (and not defined herein) shall, unless otherwise clearly stated in these Data Processing Terms, have the corresponding definition that follows from the Main Agreement.

Unless the circumstances clearly indicate otherwise, the definition used in these Data Processing Terms (and not defined herein) shall have the corresponding definition that follows from the applicable personal data legislation, including but not limited to the United Kingdom's Data Protection Act 2018 ("UK GDPR"), and Regulation (EU) 2016 / 679 (the "GDPR") and the competent supervisory authority's ("Supervisory Authority") binding decisions, regulations and general advice as well as additional local adaptation and regulation regarding data protection.

14.2 Data Processing

As a data processor, the Processor is responsible for performing all processing of personal data for the Controller in accordance with these Data Processing Terms, in accordance with applicable personal data legislation, Supervisory Authority's regulations and general advice, industry standards and in accordance with written instructions provided by the Controller, from time to time, regarding the processing of personal data.

The Processor and the person or persons working under the Processor's management shall only process personal data in accordance with the documented instructions provided by the Controller from time to time and not for purposes other than those for which the Processor has been engaged. In order to avoid misunderstandings, these Data Processing Terms and the Main Agreement in general shall be considered to constitute the Controller's instructions to the Processor regarding processing of personal data.

If the Processor considers that the Processor does not have sufficient instructions or other information regarding how the processing of personal data on behalf of the Controller should take place, the Processor shall ensure that such instructions or information are obtained from the Controller. The Processor shall without undue delay notify the Controller if the Processor considers that an instruction is in violation of the personal data legislation in force at any given time or in violation to other personal data legislation of the union or the member states.

The Processor undertakes, without limitation in time, to treat personal data processed under this Data Processing Agreement confidential and not to disclose such personal data to third parties except in accordance with these Data Processing Terms.

The Processor shall ensure that personal data is not processed for longer than is necessary and what is permitted under these Data Processing Terms.

The Processor undertakes to keep a written record of personal data processing under these Data Processing Terms containing the information specified in Article 30 (2) of the GDPR.

14.3 Security etc.

The Processor shall take the technical and organizational measures required by applicable personal data legislation to protect the personal data it processes under these Data Processing Terms against destruction, loss, alteration, unauthorized distribution, unauthorized access and any other type of unauthorized processing. The measures must be adapted to a level that is appropriate with regard to the sensitivity of personal data, the specific risks that exist, existing technical possibilities and the costs of implementing the measures.

The Processor shall document the security measures taken in accordance with clause 4.1 and provide such documentation to the Controller upon request.

The Processor shall comply with any decisions of the Supervisory Authority regarding the personal data processed on behalf of the Controller and allow the Supervisory Authority to carry out supervision of the processing that takes place.

The Processor shall, without undue delay, and within 24 hours at the latest, notify the Controller upon discovery of any destruction, loss, alteration, unauthorized disclosure or access to personal data processed under these Data Processing Terms, or attempts of such incidents.

The Processor shall assist the Controller in the handling, follow-up and prevention of such incidents as specified in clause 4.4. The Processor shall also assist the Controller, as far as is reasonable, with the Controller's prior consultation with the Supervisory Authority and the Controller's impact assessment carried out in accordance with Articles 35 and 36 of the GDPR.

The Controller has the right to audits, by itself or through an independent third party, at the Controller's expense, that the Processor fulfills its obligations under this Data Processing Agreement. The Processor undertakes to reasonably assist the Controller during such audits and to provide such documentation as the Controller needs.

14.4 Access

Access to personal data processed under this Agreement shall be restricted. Only employees of the Processor and consultants hired by the Processor who need access to personal data due to the execution of commitments to the Controller shall have access to personal data.

The Processor undertakes to ensure that its employees and hired consultants comply with this Data Processing Agreement including the Controller's instructions and that they are kept up to date on the content of other applicable personal data legislation and that such employees and consultants have undertaken to observe confidentiality.

14.5 Transfer of personal data to a third country

The Processor may not transfer personal data to third countries (other than the UK) without the Controller's written consent. Transfer of personal data to a third country may only take place if the recipient is in a country with an adequate level of protection or another specifically stated lawful basis for the transfer of personal data to a third country. The same applies when personal data is stored within the EU/EEA, but may be accessed outside the EU/EEA.

14.6 Sub-processors

The Processor is not entitled to hire sub-processors to carry out the work in accordance with these Data Processing Terms without first obtaining the written approval of the Controller. If the Controller has given such written approval, the Processor shall ensure that such sub-processor enters into a written sub-processing agreement before the sub-processor begins work related to the Controller. Such a sub-processing agreement shall at a minimum contain the undertakings and obligations arising from these Data Processing Terms.

The Controller shall, upon request, receive an accurate and up-to-date list of the sub-processors hired by the Processor in accordance with clause 7.1 and also receive copies of the associated sub-processing agreements.

The Controller has the right to require the Processor to check that its sub-processors comply with applicable personal data legislation, or to assist the Controller in such control.

If a sub-processor does not fulfill its obligations regarding the processing of personal data under these Data Processing Terms, the Processor is fully responsible to the Controller for the sub-processor's fulfillment of its obligations.

14.7 Request for information

In cases where a data subject, or other third-party requests information from the Processor regarding the processing of personal data under these Data Processing Terms, the Processor shall refer such data subject or other third party to the Controller. The Processor may not disclose information without the express instruction of the Controller.

If a public authority requests such information as follows from clause 8.1, the Processor shall immediately notify the Controller of such request and the Processor and the Controller shall in consultation agree on the appropriate procedure.

The Processor may, in cases other than those of clauses 8.1 and 8.2 above, only disclose information to third parties if the Processor has been expressly instructed to do so by the Controller.

14.8 Rights of the data subject

The Processor shall implement appropriate technical and organizational measures in order to assist the Controller in fulfilling the Controller's obligation to respond to requests for exercising the rights of the data subjects pursuant to GDPR chapter 3.

14.9 Liability

The Processor shall indemnify the Controller for damage as a result of the Processors processing of personal data in violation of this Data Processing Agreement.

14.10 Term and Termination

This Data Processing Agreement enters into force in connection with the Main Agreement being signed by both Parties and is valid until the Processor's processing of personal data under these Data Processing Terms ceases or is replaced by new Data Processing Terms.

Upon termination of the Main Agreement, the Processor shall return all personal data to the Controller in the manner instructed by the Controller or, should the Controller give such instruction in writing, destroy all data related to the Data Processing Agreement, unless the Processor is prevented by statutory law from deleting the Personal Data.

Following the termination of the Main Agreement, the Processor is not entitled to store any personal data belonging to the Controller and as soon as the Processor fulfils what follows from the Data Processing Terms, the Processor's right to process or otherwise use personal data belonging to the Controller ceases.

Provisions in these Data Processing Terms which by their nature are intended to continue to apply after the termination of the Main Agreement, including but not limited to clause 9 (Liability), shall continue to be valid after the termination of the Main Agreement.

14.11 Assignment

A Party is not entitled to transfer all or part of its rights and/or obligations under these Data Processing Terms without the prior written consent of the other Party.

14.13 Applicable law and disputes

Applicable law and where disputes are to be settled is stated in the Main Agreement.

Processing of Personal data

1. personal data being processed

Specify the types of personal data that the Processor has access to through the Main Agreement.

Personal name, e-mail, telephone number, password, IP address, location information (GPS), search history in the Application and booking history in the Application.

2. categories of data subjects

Describe the persons whose information is processed, for example clients, employees or jobseekers.

Customers/Users who use the facility.

3. description of personal data processing

Describe the processing of personal data that takes place on behalf of the Controller. Indicate in particular whether processing of personal data may take place through cloud services.

The Processor processes the information in order to be able to administer a booking, purchase or equivalent of a start time, membership, product on a golf facility. The booking is made through a cloud service.

4. storage time

Specify how long the personal data is stored.

The personal data will be stored for as long as the Main Agreement applies between the Parties.

5. were the processing takes place

Indicate in which countries the processing will take place. This includes e.g., where the personal data is stored, where the employees of the Processor are located when they have access to the data and where subcontractors including cloud service providers are located.

Sweden, Ireland, Ukraine and the United States.

6. subcontractors

List all subcontractors that may process personal data belonging to the Controller.

Amazon (AWS), Adyen, Sentry, Mailchimp, Instabug, Intercom.

7. miscellaneous

If the Processor wants to specify something further, there is room to do this below.

The Processor works actively to ensure compliance with current regulations.

8. specific instructions for the processor

To be communicated by the Facility to Sweetspot.