General Terms and Conditions

2. Term and Timeline

1. The term of this Agreement shall commence on the Effective Date and shall continue until terminated as provided for in this Agreement (“Term”).
2. This Agreement shall automatically renew for subsequent Subscription Periods and/or subsequent Support and Maintenance Periods for Hardware, unless terminated as provided in this Agreement.
3. Any Order Document shall automatically renew for subsequent Subscription Period and/or subsequent Support and Maintenance Periods for Hardware, unless:
   
   1. the Client provides to Shiji written notice of its election not to renew an Order Document at least ninety (90) days prior to end of the then-current Subscription Period/Support and Maintenance Period for Hardware or otherwise terminates this Agreement pursuant to the terms of this Agreement. The
      termination shall, in any event, be deemed to have been received if it was sent by registered letter to the address indicated on the Master Services Agreement at least ninety (90) days prior to the expiry of a then-current Subscription Period/Support and Maintenance Period for Hardware; or
   2. Shiji provides to the Client written notice of its election not to renew an Order Document at least ninety (90) days prior to the end of the then-current Subscription Period/Support and Maintenance Period for Hardware or otherwise terminates this Agreement pursuant to the terms of this Agreement. The termination shall, in any event, be deemed to have been received if it was sent by registered letter to the address indicated on the Master Services Agreementat least ninety (90) days prior to the expiry of a relevant Subscription Period/Support and Maintenance Period for Hardware.

3. Specific Provisions applicable to Software as a Service and/or Consulting Services

The provisions of this Section 3 only apply to the provision of Software as a Service and/or Consulting Services

Rights Granted

1. Subject to the terms and conditions of this Agreement, Shiji grants to the Client and the Client accepts from Shiji and for the duration of the Term, a limited, non-exclusive, non-transferable right to access and use and permit Authorized Users to access and use the Services solely for the Client’s internal business use. The Client may allow Authorized Users to use the Services for this purpose and is responsible for Authorized User’s compliance with this Agreement.
2. The Client acknowledges that Shiji has no obligation to deliver or ship copies of the Software to the Client as part of the services. The Client does not acquire under the Agreement any License to use the Software in excess of the scope and/or duration of the Services.
3. The Client acknowledges that the Client shall not (i) make the Software or materials resulting from the Services available in any manner to any third party for use in the third party’s business operations, (ii) access or use the Services in order to build or support, and/or assist a third party in building or supporting, products or services competitive to Shiji, (iii) disclose to any third party results of any services or program benchmark tests without Shiji’s prior written consent, and (iv) license, sell, rent, lease, transfer, assign, distribute, display, host, outsource, disclose, permit timesharing or service bureau use, or otherwise commercially exploit or make the Services available, to any third party.
4. No obligation to use: Nothing in this Agreement shall be deemed to obligate the Client to use the Services. The initial use, the extent of use, and the continuation of use of the Services by the Client shall at all times be within the sole discretion and control of the Client. Notwithstanding the foregoing, the Client’s failure to use the Services shall not relieve the Client of any of its obligations hereunder, including without limitation payment obligations.
   
   Accessibility to Services
5. Shiji shall use commercially reasonable efforts to make the Services available on a 24/7 basis (twenty-four hours per day, seven days per week) during the relevant Subscription Period.
6. Shiji Software is a SaaS-application. The respective scope of performance depends on the used software version. The Client notes that a functioning internet access (with adequate bandwidth and reaction speed) for all terminal devices is necessary in order to use all program functions. Shiji is not liable for disturbances to the Services which occur due to an insufficient internet connection.
7. Shiji will monitor performance indicators on the systems and network infrastructure (its own and that of third-party suppliers) in order to gauge the overall performance of its hosting services and will take reasonable steps to address systems and network infrastructure as required to maintain satisfactory performance of the Software.
8. For the avoidance of doubt, downtime caused directly or indirectly by any of the following shall not be considered a breach of this Agreement: (i) scheduled system back-up or other on-going maintenance as required and scheduled in advance by Shiji or (ii) a fault or failure of the internet or any public telecommunications network or (iii) denial of service attacks or similar attacks or (iv) a fault or failure of the Client’s computer systems or networks or (v) for any Force Majeure Events set forth in this Agreement.
9. The Client shall use reasonable endeavours, including reasonable security measures relating to Account access details, to ensure that no unauthorized person may gain access to the Services. For more details on the Client’s obligation on security measures see clause 6 below.
10. The Client must not use the Services in any way that causes, or may cause, damage to the Services, Products or platform or impairment of the availability or accessibility of the Services.
    
    Support and Maintenance for Software as a Service
11. Shiji shall provide the support services to the Client during the relevant Subscription Period. Details regarding the support services are being specified in the Service Level Agreement.
12. Shiji shall maintain the Software and/or Services and provide all patches and fixes to the Software and/or Services at no additional cost during the relevant Subscription Period. Provided, however, said maintenance shall not include any major releases of new versions of the Software, additional functionality, or custom programming, which Shiji, at its discretion, may provide at an additional cost as otherwise agreed between parties.
    
    National laws for the use of Cloud based Software as a Service
13. Shiji has explicitly pointed out that, every country has respective legal provisions concerning the use of cloud based Software as a Service. Shiji cloud based Software as a Service complies with the legal regulations at the time of execution of the Agreement. If the Client informs Shiji about the legislative amendments in writing, Shiji shall use its reasonable endeavour to modify the Software within a reasonable period of time.
    
    Disclaimer of Warranties
14. The Client acknowledges that complex Software is never wholly free from defects, errors and bugs, security vulnerabilities and subject to the other provisions of this Agreement, Shiji gives no warranty or representation that the Services will be wholly free from defects, errors and bugs or uninterrupted and will be entirely secure. The Client acknowledges that Shiji does not control the transfer of data over communications facilities, including the internet, and that the Services may be subject to limitations, delays, and other problems inherent in the use of such communications facilities. Shiji is not responsible for any delays, delivery failures, or other damage resulting from such problems.
15. Shiji, Shiji’s Affiliates may compile comments or opinions, hotel reviews, videos, images, blog entries, article postings, references and other information (“Internet Content”) in some of its Products which have been obtained through automated means from the Internet. The Client acknowledges that Shiji aggregates and provides, but does not generate, the Internet Content. Therefore, Shiji is not liable for the Internet Content accuracy or for any possible errors or omissions in or distortion or manipulation of the information made available to the Client through its Products. The Client expressly acknowledges that Shiji may block certain comments using specific keyword.
16. Neither party shall have any liability with respect to the performance of Third Party Software. Shiji provides no warranties, expresses or implied, with regards to Third Party Software, and Shiji will not be liable for any failure of any Third Party Software to function as expected or intended.
    
    Shiji’s Payment Products
    The following provisions 3.17. – 3.19. only apply to the provision Shiji’s Payment Products
17. ‍Shiji’s Payment Products are Shiji’s Products enabling the charging of any Guest through their account with Billing Partners, for Transactions made by Guests of the Client.
18. Shiji, Shiji’s Affiliates and/or Billing Partners may block Guests from performing Transactions through the System at their own and sole discretion, provided that such action will be in coordination with the Client.
19. The Client shall be solely responsible and liable with regards to any content (in any format or outlay) and/or any information displayed on the Client’s Site, or otherwise. The Client shall indemnify and hold Shiji, Shiji’s Affiliates and its Billing Partners harmless, from and against any and all loss, damages, claims and liabilities arising out of or in relation to Client’s Site and/or any content (in any format or outlay) and/or any information displayed on the Client’s Site, including without limitation in relation to: (i) goods, services, downloads, which may be obtained through the Client’s website, the supply thereof; and the commercial terms of a Transaction, including its annulment; (ii) Client’s breach of any applicable laws; and (iii) infringement of third party's rights, including Intellectual Property Rights, by Client’s Site and/or any content (in any format or outlay) and/or any information displayed on the Client’s Site, or any element thereof.
    
    PCI DSS
20. Where Shiji receives Payment Card Data, Shiji shall and shall cause Shiji Agents and the Services at all times to comply with the Payment Card Industry Data Security Standards (including the Payment Application Data Security Standards), as amended or updated from time to time (the “PCI -DSS”).
21. It is the responsibility of the Client to respect and enforce the following operational processes:
    
    1. If the Client has access to or will collect, access, use, store, process, dispose of or disclose credit, debit or other payment cardholder information using the Services provided by Shiji, the Client shall at all times remain to be in compliance with the PCI-DSS requirements, including remaining aware at all times of changes to the PCI-DSS and promptly implementing all procedures and practices as may be necessary to remain in compliance with the PCI-DSS.
    2. At a minimum, the Client’s safeguards for the protection of Personal
       Data shall include:
       
       1. limiting access of Personal Data or highly sensitive information to Authorized Users;
       2. implementing appropriate personnel security and integrity procedures and practices (including, but not limited to, conducting background checks consistent with applicable law); and
       3. providing appropriate privacy and information security training to Client’s employees.
       4. ensuring that all users can be clearly identified in the systems and services and that login credentials are not shared among the users: and
       5. implementing strong password policy including: required password retention period, length, complexity, password history, account lockout after number of unsuccessful login attempts, maximum time of a session and automatic termination of idle session.
22. For a more detailed description of PCI Security Standards requirements related to identity and access management please see the official PCI DSS documents.
23. During the term of each Authorized User’s employment by the Client, the Client shall at all times cause such Authorized User to abide by the Client’s obligations under this Agreement and the Client’s standard policies and procedures. The Client, further agrees that it shall maintain a disciplinary process to address any unauthorized access, use or disclosure of Personal Data by any of Client’s officers, partners, principals, employees, agents or contractors.

4. Specific Provisions applicable to Hardware

The provisions of this Section 4 only apply for the order, delivery and warranty processing of Hardware

Title, Delivery of Hardware and its Warranty

1. Title: Shiji and its Suppliers retain title to any Hardware being provided hereunder until shipment thereof. Upon shipment, title to the Hardware passes to Client.
2. Delivery of Hardware: Shiji will endeavour in good faith to deliver Hardware within the time specified in Shiji's order acceptance. Shiji shall not be liable for any delay in delivery or failure by the shipper to deliver. All claims for shortage or damage before delivery shall be deemed waived unless the Client delivers written notice of a claim to Shiji within ten (10) days after delivery of the Hardware to the Client. Upon shipment, the Client bears all risk of loss or damage to the Hardware from any cause whatsoever.
3. Return: Hardware may not be returned without prior return authorization. Any Hardware returned due to changes in configuration or otherwise at the Client’s request (other than for warranty service) will be subject to a restocking fee of 20% of the cost of the Hardware. If Shiji determines that the Client has used the Hardware, Shiji may assess an additional restocking charge, not to exceed in the aggregate 50% of the cost of the Hardware. For clarity, the fees in this clause do not apply to Hardware returned for warranty service. The import charges and other incidental charges incurred by the Client will not be refunded.
4. Upon delivery, the Hardware will be in good working order, and will be new unless otherwise agreed with the Client. The applicable warranty period shall be specified in the relevant Order Document signed by the Client. During the applicable warranty period, should any part of a Hardware Product prove to be defective in material or workmanship, Shiji will repair or replace such part at no charge to the Client, including parts and labour. Shiji will provide the Client with Hardware warranty services in accordance to the procedures determined for the Support and Maintenance for Hardware attached hereto in Schedule III of this Agreement.
5. Warranty coverage will not be extended for repairs made necessary by damages due to fire, water, storm, burglary, power line fluctuations, spillage, accident, negligence, or abuse. The warranty specifically excludes damages to printer heads or printer motors caused by paper jams (unless persistent paper jams are caused by defective hardware) or insertion of foreign objects between the printer head and the print surface. Only upon the Client request and only after the Client approves the estimated costs to repair will Shiji repair or replace equipment damaged by one or more of the foregoing causes or events.
   
   Warranty and Remedy
6. Limited warranty for Hardware Products: For any warranty period as specified on applicable Order Document, or any other warranty period as agreed in any other agreement between Shiji and Client, from and including the date that Shiji delivered and completed Hardware Product to Client, Shiji warrants Client that such Hardware Product, when properly installed and properly used will function in all material respects as described in the Order Document or any other agreement between Cient and Shiji.
7. any Hardware Product that has been (a) modified or added by the Client or a third party, (b) used in combination with equipment or software other than that which is consistent with the Order Document or any other agreement between Client and Shiji, or (c) misused or abused.
8. Any indications of time/periods contained in offers made by Shiji or in schedules hereto shall be deemed estimated.
9. Disclaimer of Warranties: Except as expressly set forth above, Shiji makes no warranty or representation regarding any Products, information or services provided under this agreement. Shiji does not warrant or guarantee that the Products, or the support provided hereunder will satisfy Client’s requirements, or that the operation of such will be uninterrupted or error free.
10. Remedy: Shiji’s sole obligation under the warranty itself, with respect to Hardware Products, is limited to the repair or replacement of the products or parts thereof, and, with respect to services for installation of Hardware, to the re-performance of the services for installation of Hardware, in each case at no additional charge to the Client.
    
    Shiji’s Manufacturer’s Warranty for Third Party Hardware
11. For the Client’s convenience Shiji may make Third Party Hardware available to the Client.
12. Shiji however does not offer warranty for such items and assumes no responsibility or liability whatsoever for any Third-Party Hardware. The sole responsibility for the items lies with the manufacturer and all issues regarding said warranty should be addressed directly to the manufacturer.
13. It is however allowed for Shiji to pass the manufacturer’s warranties to Client, when and to the extent Shiji is permitted to do so. In such case, Shiji assigns, and Client accepts the assignment of any warranties made by the manufacturers or Shiji’s Hardware supplied by Shiji hereunder that is not subject to a Shiji warranty. Said assignment shall take effect upon delivery of and payment in full for the Hardware by Client to Shiji.
14. Should any part of the Hardware subject to manufacturer’s warranty prove to be defective in material or workmanship, the Client’s exclusive right and remedies are as provided in manufacturer’s warranty. Repair or replacement is at the discretion of the manufacturer. Shiji is not responsible for any failure by the original manufacturer.
    
    Support and Maintenance for Hardware
15. If the Client has purchased Support and Maintenance for Hardware, Shiji shall provide the relevant Support and Maintenance for Hardware to the Client during the Support and Maintenance Period for Hardware as defined in the relevant Order Document.
16. Shiji shall make available to the Client a helpdesk in accordance with the provisions of Schedule III to this Agreement. Shiji shall provide the Support for the Hardware with reasonable skill and care in accordance with the standards of skill and care at least as good as those expected from a leading service in Shiji's industry.
17. Shiji shall respond promptly to all requests for Support for the Hardware made by the Client through the helpdesk.
18. Shiji will support the Hardware in accordance with the terms and conditions of the applicable Schedule, attached, and the Client agrees to purchase support for the Hardware during the Support and Maintenance Period for Hardware as determined in the relevant Order Document. Shiji will offer for additional fees support hereunder for at least three (3) years, starting on the Support and Maintenance Period Start Date, provided: (i) the Client is not in default hereunder; and (ii) the Client has paid all Support Fees and other amounts owed to Shiji, whether under this Agreement or otherwise.
19. Shiji shall not provide any support necessitated by, and disclaims all damages arising in connection with, data corruption or disruption caused by third-party products or modification of the Hardware. Shiji shall not be liable, and shall charge the Client at standard rates, for any costs or for performing any services hereunder arising in connection with the Client’s negligence, abuse, misuse, or failure to perform routine maintenance and standard operating procedures.

General Provisions

The provisions below apply to any Products and Services provided by Shiji to the Client, including without limitation providing Software as a Service, Consulting Services and Hardware.

5. Installation, Training and Consulting Services

Note that each Order Document may include dedicated Exhibits.

1. Installation of Hardware Products: Shiji and the Client shall establish a mutually agreeable date for installation of the Hardware, as set forth in the relevant Order Document. Installation costs and fees, if applicable, will be stated in the relevant Order Document. The Client recognizes the importance of honouring the scheduled installation date and shall promptly notify Shiji in writing if the Client is required to delay the scheduled installation date. Any such Client written notice of delay shall be provided at least ten (10) days prior to the scheduled installation date.
2. Training: Shiji hereby agrees to offer the Client training on the use of Products, in accordance with the fees set forth in the applicable Order Document. Shiji shall provide training only to the Client employees and such of the Client representatives as the Client may determine at its sole discretion, and Shiji’s sole obligation for training will be to supply a qualified instructor for the designated number of training hours. Shiji does not guarantee that, after such training, the trainees will be able to use or operate the Products properly. Upon the Client’s request, Shiji will provide additional training time beyond the amounts stated on the relevant schedule attached to the Order Document signed by the Client at Shiji’s then-prevailing rates for training. The Client agrees that it may not offer its trained employees to other third parties for the purpose of resale. Shiji and the Client will mutually agree upon a training schedule.
3. Consulting Products: Shiji hereby agrees to provide to the Client certain Consulting Services, only in accordance with the rates, terms and conditions set forth on the applicable Schedule, a copy of which will be attached to the relevant Order Document.
4. Quotes for Installation of Hardware Products and Training are based on an 8-hour workday. If Shiji provides Installation of Hardware Products and Training in excess of eight (8) hours in any single workday, Shiji reserves the right to charge the Client for such additional time at the hourly rate of 1.5 times the pro-rated daily rate. For the exceptional event that Shiji the Installation of Hardware Products and/or Training takes place on a Sunday or a public holiday, Shiji reserves the right to charge the Client for such additional time at the hourly rate of 2.0 times the pro-rated daily rate.
5. In addition to the above fees for Installation of Hardware, Training and Consulting Products, the Client agrees to pay all travel, accommodations and other reasonable expenses incurred by Shiji’s employees, subcontractors or agents in connection with the installation of and training of the Products. Shiji shall endeavour to obtain reasonable available airfares. Travel and related expenses will be invoiced when incurred by Shiji and shall be paid by Client within 20 days after receipt by Client.

6. Client’s obligations

1. The Client is solely responsible for the provision, installation, configuration, inspection, monitoring and maintenance of any Client-owned equipment, including but not limited to any requisite AC-power lines and any electrical or networking installation (“Client Equipment”) unless expressly assigned to Shiji via applicable Order Document. Client shall ensure that Client Equipment is connected and used in accordance with any instructions and safety and security procedure, which may be provided by Shiji upon Client’s written request and applicable to the use of such Products and/or Services. Upon Client’s written request, Shiji will provide the Client with documentation concerning the requirements for dedicated, isolated, and insulated AC-power lines for
   hardware. Shiji’s warranties are conditioned upon the Client providing environmental and operating conditions confirming in all material respects to Shiji’s specifications. Client waves any claims, without limitation, including warranty claims against Shiji, if the environmental and operating conditions do not conform in all material respects to Shiji’s specifications.
2. Shiji and Shiji’s Affiliates do not make any commitment with respect to the interoperability between a Product and/or Service and Client Equipment, except that, in the case of Products and/or Services sold for the purpose of Client’s use with Products and/or Services, Client may rely upon Shiji’s representations as to compatibility and compliance, as of the date of provision.
3. The Client and Shiji agree that the Client is the Controller of Personal Data and Shiji is the Processor of entrusted data in accordance with the “Data Processing Agreement” set out in Schedule I of this Agreement. Further to that, the parties acknowledge and agree that:
   
   1. The Client is solely responsible for implementation of appropriate technical and organizational security measures for components that the Client provides or controls. Such measures may include but are not limited to access control and credentials protection, network protection, encryption, anti-virus protection, privacy and security awareness training, etc.;
   2. The Client is solely responsible for any vulnerabilities, and the consequences of such vulnerabilities, arising from the Client’s content and applications, including any viruses, trojan horses, worms or other programming routines contained in the Client’s content and applications that could limit or harm the functionality of a computer or that could damage, intercept or expropriate data; and
   3. The Client is liable for the misuse of user names and passwords. The Client shall use reasonable endeavours, including reasonable security measures relating to account access details, to ensure that no unauthorized person may gain access to the Products.

7. Intellectual Property Rights

1. The Client acknowledges that all rights, titles, and interests in and to the Products including the Hardware, Services and the Software, together with its codes, derivative works, organization, structure, interfaces, any documentation, data, trade names, trademarks, trade secrets, proprietary information or other related materials is, and at all times shall remain, the sole and exclusive property of Shiji or its licensors. Except for such rights granted, as expressly provided herein, this Agreement does not grant to the Client any rights to, or in, patents, copyrights, database rights, trade secrets, trade names, trademarks (whether registered or unregistered) or any other rights or licenses with respect to the Products including the Hardware, Services and the Software.
2. Client shall not remove or modify any program markings or any notice of Shiji or its licensors’ proprietary rights. Client shall not attempt, or directly or indirectly allow any authorized user or other third party to attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, reverse compile, disassemble, reverse engineer, download, transmit or distribute all or any portion of the Products in any form or media or by any means or attempt to circumvent any licensing requirements hereunder. Shiji reserves all other rights not expressly granted to the other party hereunder.
3. Client hereby grants Shiji a personal, royalty-free, world-wide, non-exclusive, non-transferrable limited right and license, with no right to sub-license, during the Term to use Client's trademarks, service marks and trade names only for the performance of Shiji’s services and obligations under this Agreement.

8. Client Data

1. The Client warrants to Shiji that the Client Data when used by Shiji in accordance with this Agreement will not infringe the Intellectual Property Rights or other legal rights of any person, and will not breach the provisions of any law, statute or regulation, in any jurisdiction and under any applicable law.
2. Shiji, Shiji’s Affiliates and their licensors may compile statistical information related to the performance of the Products and Services, and may make such information publicly available, provided that such information does not incorporate the Client Data and/or identify the Client Confidential Information or include the Client company’s name. Shiji retains all Intellectual Property Rights in such information.
3. Client hereby grants to the Shiji the non-exclusive right and license, subject always to all Data Protection Requirements (if applicable), to (i) receive, retrieve, process, use and transmit any Client Data, Transaction Session Data and/or Guest Data necessary or reasonably desirable for the performance of Shiji’s Services and/or use of Shiji’s Products; and (ii) use, copy, archive, utilize and store any Client Data, Transaction Session Data and/or Guest Data that will be will be archived, stored or otherwise transmitted in connection with Shiji’s Services and/or Products.

9. Confidentiality

Both parties are bound by the confidentiality obligations set out in Schedule II of this Agreement as well as in the “Data Processing Agreement” set out in Schedule I of this Agreement. Where there is any conflict between any provision in relation to confidentiality, the stricter provision (i.e. favouring non-disclosure) shall prevail.

10. Charges

1. The Client or the Participating Hotel(s) shall pay the Charges to Shiji in accordance with the applicable Order Document, as the case may be.
2. If the Charges are based in whole or part upon the time spent by Shiji performing its services, Shiji must obtain the Client's written consent before performing the said services.
3. All amounts stated in or in relation to Order Document unless the context requires otherwise, are exclusive of any applicable Taxes, which will be added to those amounts and payable by the Client to Shiji.
4. Shiji may elect to vary any element of the Charges by giving to the Client not less than 30 days' written notice of the variation prior to the commencement of the new Subscription Period or Support Period provided that no such variation shall result in a percentage increase in the relevant element of the Charges greater than CPI of the immediately preceding Subscription Period or Support Period or 5%, whichever is higher.
5. The Client acknowledges that some of the Charges paid to Shiji under the Order Document, as specified on the relevant schedule attached to the Order Document, or on the Order Document itself, may be dispersed to other parties, including, without limitation, third party service provider to Shiji, third party components supplier to Shiji, franchisors and management companies.

11. Payments

1. Shiji shall issue invoices for the Charges to the Client or the Participating Hotel(s) in accordance with terms set out in the applicable Order Document, as the case may be.
2. The Client or the Participating Hotel(s) must pay the Charges that have become due and payable to Shiji within the period thirty (30) days following the receipt of a validly issued invoice in accordance with this Section 11.
3.  If the Client or the Participating Hotel(s) does not pay any amount properly due to Shiji under this Agreement, Shiji may charge the Client or the Participating Hotel(s) interest on the overdue amount at the rate of 8% per annum which interest will accrue daily until the date of actual payment and be compounded at the end of each named calendar month.
4. Client or the Participating Hotel(s) shall be in default of this Agreement if Client or the Participating Hotel(s) fails to make any payment when due and fails to cure said default within seven (7) days after receipt of written notice thereof from Shiji.
5. In the event of any default by Client or the Participating Hotel(s) in the payment of any amounts due hereunder, which said default continues uncured for at least five (5) calendar days after receipt of written notice thereof from Shiji, Shiji shall have the right to suspend or cease the provision of any services under this Agreement unless and until such default has been cured.

12. Compliance with Laws

1. Shiji will comply with laws and regulations applicable to its provision of Products, including notification of Personal Data breach. However, Shiji is not responsible for compliance with any laws, regulations, recommendations or other non-binding documents applicable to the Client that are not simultaneously binding to Shiji itself.
2. The Client must comply with laws and regulations applicable to its use of Products, including, but not limited to Data Protection Laws.

13. Indemnification for infringement of Intellectual Property

1. Either party agrees to indemnify, defend and hold the other party harmless from any and all direct and actual damages arising directly from actual infringement of a third party’s Intellectual Property Rights. In such an event, Shiji’s sole obligation would be the replacement of the infringing intellectual property with alternate Intellectual Property with substantially similar functionality that is not infringing, or modification of the Intellectual Property in such a manner that renders it non-infringing. If any action shall be brought against other party in respect to which indemnity may be sought from the party pursuant to this Section 13 (hereinafter in this Section 13, a “Claim”), the other party shall promptly notify the party in writing, specifying the nature of the Claim and such relief as is sought therein. Party may, at its sole discretion, at any time upon written notice thereof to the other party undertake to conduct all proceedings or negotiations in connection therewith, assume the defence thereof, and if it so undertakes, it shall also undertake all other required steps or proceedings to settle or defend any such action, including the employment of counsel. In such an event, the
   other party shall cooperate with the party in all reasonable respects in connection with the defence of any such action. Other party shall have the right to employ separate counsel and participate in the defence thereof at its own expense.
2. Shiji shall have no obligations under this Section 13 if the actual infringement is due to any of the following: (i) Client’s breach of this Agreement; (ii) the Intellectual Property or any portion thereof has been modified, altered or changed in any manner by the Client or any party acting on the Client’s request, if such actual infringement
   would have been avoided in the absence of the use of such altered Intellectual Property; (iii) the combination, operation or use of the Intellectual Property with any software, operating system, and/or hardware not provided by Shiji, if such infringement would have been avoided in the absence of such combination, operation, or use; (iv) the Client’s failure to install or have installed error corrections, updates/upgrades, or modifications that would have avoided the infringement and the other Party had been notified of same; or (v) any unauthorized use of the Intellectual Property by the Client; or (vi) the requirements, specifications or functionalities requested or provided by the Client.

14. Limitation of Liability

1. To the maximum extent permitted by law, in no event will either party be liable to the other party for any:
   
   1. Loss of profits or anticipated savings;
   2. Economic loss;
   3. Loss of business;
   4. Loss of revenue, or any loss of business, contracts and opportunities;
   5. Any losses arising out of a Force Majeure Event;
   6. Loss of use; loss or destruction of data;
   7. Business interruption damages;
   8. Cost of substitute hardware or services; or
   9. Any special indirect, consequential, exemplary, or incidental damages, even if such party has been apprised of the likelihood of such damages occurring.
2. These limitations apply to all causes of action in the aggregate or in the individual case as applicable, including without limitation causes of action arising out of termination of the agreement between parties, breach of contract, breach of warranty, negligence, strict liability, misrepresentation, product liability and any other torts.
3. In no event shall Shiji be liable for any damages in excess of the total amount paid and payable by the Client to Shiji under this Agreement in the twelve (12) month period preceding the commencement of the event(s). The contracting parties agree that any warranty claims and claims for damages against Shiji will be limited to the amount which the client has paid or is obligated to pay to Shiji within a twelve (12) month period. This limitation of liability also applies in the event of minor negligence. For the avoidance of doubt, party’s total liability arisingout of or related to this Agreement shall not be understood to apply individually and severally to Client and/or to any Client’s Affiliates.

15. Force Majeure Event

1. If a Force Majeure Event gives rise to a failure or delay in either party performing any obligation under this Agreement, that obligation will be suspended for the duration of the Force Majeure Event.
2. A party that becomes aware of a Force Majeure Event which gives rise to, or which is likely to give rise to, any failure or delay in that party performing any obligation under this Agreement, must:
   1. promptly notify the other party; and
   2. inform the other party of the period for which it is estimated that such failure or delay will continue.
3. A party whose performance of its obligations under this Agreement is affected by a Force Majeure Event must take reasonable steps to mitigate the effects of the Force Majeure Event.
4. For avoidance of doubt, the parties are aware of the Coronavirus (COVID-19) pandemic effective at the date of the Agreement and its anticipated effects and measures thereof and the parties concluded this Agreement pursuant to these anticipations. As such, the parties agree that pandemics and any other epidemics shall be considered as a Force Majeure Event under this Agreement. Nevertheless, based on the information available to both parties, the parties decide to conclude the Agreement and treat COVID-19 not as a Force Majeure Event under this Agreement, unless its effects and measures thereof reach an unpredictable size in future that could not be reasonably foreseen by the parties. However, if, as a result of any decision or measure taken by any governmental or local authorities due to any new international or local developments with respect to the COVID-19 pandemic (or any other epidemics), any change in the payment, supply, delivery and transportation dates determined under the Agreement becomes necessary, the parties shall negotiate in good faith a postponement.

16. Termination

1. Either party may terminate this Agreement immediately by giving written notice of termination to the other party if the other party commits a material breach of this Agreement, which such material breach is not cured after notice to the defaulting party and a continued failure to cure such breach thirty (30) days following such notice.
2. Shiji may terminate this Agreement upon failure by the Client and/or the Participating Hotel(s) to pay invoices when due with respect to the Products, Hardware and Services, which failure is not cured after notice to the Client and/or the Participating Hotel(s) and a continued failure to pay such invoices for a period of thirty (30) days following such notice.
3. Notwithstanding the above, the Client shall not be entitled to any refund of monies paid hereunder in the event the Agreement is terminated due to the Client’s default.
4. Either party may terminate this Agreement immediately by giving written notice of termination to the other party if:
   
   1. the other party:
      
      1. is dissolved;
      2. ceases to conduct all (or substantially all) of its business;
      3. is or becomes unable to pay its debts as they fall due;
      4. is or becomes insolvent or is declared insolvent; or
      5. convenes a meeting or makes or proposes to make any arrangement or composition with its creditors;
   2. an administrator, administrative receiver, liquidator, receiver, trustee, manager or similar is appointed over any of the assets of the other party; or
   3. an order is made for the winding up of the other party, or the other party passes a resolution for its winding up (other than for the purpose of a solvent company reorganisation where the resulting entity will assume all the obligations of the other party under this Agreement).

17. Effects of termination

1. Upon the termination of this Agreement, all of the provisions of this Agreement shall cease to have effect, save as provided otherwise.
2. Any related Order Document shall not terminate on the same date as this Agreement terminates, except if Shiji will provide a termination notice to the Participating Hotel after the termination of this Agreement terminating such Order Document. The parties agree that this termination will take effect on the date specified in the termination notice provided by Shiji.
3. Except to the extent that this Agreement expressly provides otherwise, the termination of this Agreement shall not affect the accrued rights of either party.
4. Within thirty (30) days following the termination of this Agreement for any reason:
   
   1. the Client must pay to Shiji any Charges in respect of Products provided to the Client before the termination of this Agreement; and
   2. Shiji must refund to the Client any Charges paid by the Client to Shiji in respect of Products that were to be provided to the Client after the termination of this Agreement, without prejudice to the parties' other legal rights.
5. In the event of a material breach by either party, the obligations of the innocent party hereunder, shall automatically terminate, and the innocent party shall have the right to seek damages or other injunctive relief, as appropriate.
6. Upon termination of this Agreement, all rights and subscriptions granted by Shiji to Client in this Agreement will terminate, Client all its Authorized Users shall cease all use of the Products and Services. The following provisions will survive the termination or expiration of this Agreement: (a) any obligation of Client to pay for Products used or Services rendered before and after termination; (b) Section 7 (Intellectual Property Rights), Section 9 and Schedule II (Confidentiality), Section 13 (Indemnity), Section 14 (Limitation of Liability); and (c) any other provision of this Agreement that must survive to fulfill its essential purpose.

18. Subcontracting

1. Shiji reserves the right to provide the Products from worldwide locations, and/or through use of Shiji Affiliates and/or subcontractors, worldwide.
2. Shiji shall remain responsible to the Client for the performance of any subcontracted obligations.
3. Notwithstanding any other provisions of this Agreement, the Client acknowledges and agrees that Shiji may subcontract to any reputable third-party hosting business and the provision of Products in relation to the support and maintenance of it.

19. Miscellaneous

1. To the extent permitted by applicable law, the parties hereby waive any provision of law that would render any clause of this Agreement invalid or otherwise unenforceable in any respect. If any provision of this Agreement is determined by any court or other competent authority to be unlawful and/or unenforceable, the other provisions of this Agreement will continue in effect. If any unlawful and/or unenforceable provision would be lawful or enforceable if part of it were deleted, that part will be deemed to be deleted, and the rest of the provision will continue in effect (unless that would contradict the clear intention of the parties, in which case the entirety of the relevant provision will be deemed to be deleted). All of the provisions of this Agreement will be interpreted to achieve its original effect to the maximum extent permitted by applicable law.
2. This Agreement may not be varied except by a written variation agreement signed by or on behalf of each of the parties.
3. Client shall not assign its rights under this Agreement without Shiji’s prior written consent.
4. The services to be performed by Shiji under this Agreement are those of an independent contractor. Each party agrees that it is neither the agent of, nor legal representative of the other, and neither has the right or authority to make any warranties or promises or to incur any obligations on behalf of the other, and that no employee or agent of either party is or shall be deemed an employee of the other.
5. This Agreement shall be construed in accordance with and be governed by the state and national laws applicable to the jurisdiction identified in the Master Services Agreement (“Applicable Law”), without reference to: (a) any conflicts of law principle that would apply the substantive laws of another jurisdiction to the parties’ rights or duties; (b) the 1980 United Nations Convention on Contracts for the International Sale of Goods; or (c) other international laws. The parties consent to the exclusive jurisdiction and venue of the courts in the Jurisdiction identified in the Master Services Agreement, for all claims or actions arising under or relating in any way to this Agreement or the relationship between the parties, whether sounding in contract, tort, common law, or otherwise, and regardless of whether persons or entities who are not party to this Agreement are parties to such action.
6. This Agreement contains all agreements of the parties with regard to its subject matter and replaces and supecedes all prior or contemporaneous communications, negotiations, discussions, agreements and understandings, whether electronic, oral or written, between the parties with regard to the subject matter of this Agreement. Neither party has relied upon any such prior or contemporaneous communications.
7. In the event of any conflict between the terms and conditions contained in clauses 1 to 19 of Shiji Group’s Gerneral Terms and Conditions, the Schedules attached to Shiji Group’s Gerneral Terms and Conditions, and an Order Document, the following order of priority shall apply:
   
   1. the terms and conditions contained in Shiji Group’s Gerneral Terms and Conditions;
   2. the Schedules attached to the Shiji Group’s Gerneral Terms and Conditions;
   3. the Order Document.

Schedules:

SCHEDULE I – Data Processing Agreement

This Data Processing Agreement and its Annexes (collectively referred as the “DPA”) forms part of the “Agreement” concluded between Shiji (“Us”, “We”, “Our”, “Service Provider” or “Processor”) and Client (Collectively, “You”, "Your”, or “Controller”) and reflects the parties’ agreement with regard to the Processing of Client Personal Data in the performance of the Agreement. Both parties shall be referred to as the “parties” and each, a “party”.

WHEREAS, Shiji shall provide the Services as set forth in the Agreement and/or as further described in the related “Order Document” (as such term is defined under the Agreement); and WHEREAS, In the course of providing the Services pursuant to the Agreement, Shiji will Process Client Personal Data on its Clients’ behalf in the capacity of a Processor and only on the written instruction of the Client in accordance with this DPA.

1. How this DPA applies

1. Which Client entities can be a party to the DPA. The following entities can be a party to the DPA: (i) the entity that signs the Agreement; (ii) the entity or its Affiliates who sign an Order Document (as defined under the Agreement); and (iii) other Participating Hotels (as defined under the Agreement) that are entitled to use the contracted Shiji Services.
2. Contractual Relationship. Each Processor and Controller enters into this DPA on behalf of itself and its Affiliates, to the extent required under applicable Data Protection Laws, if and to the extent Shiji processes Personal Data for which such Clients’ Affiliates (including the Participating Hotel) qualify as the Controller. Each Client’ Affiliates agrees to be bound by the obligation under this DPA.
3. Communication. The Client that is the contracting party to the Agreement shall remain responsible for coordinating all communication with Clients’ Affiliates under this DPA and shall be entitled to make and receive any communication in relation to this DPA on behalf of its Affiliates.

2. Status of the parties

1. The types of Personal Data Process pursuant to this DPA and the subject matter, duration, nature and purpose of the Processing, and the categories of Data Subjects are described in Annex 1 hereto.
2. Shiji is a Processor of Client Personal Data Processed on behalf of its Clients who are the Controllers with respect to such Client Personal Data and with respect to which parties have entered into Agreement and this DPA governing the Processing by Shiji of such Client Personal Data.
3. In respect of the parties’ rights and obligations under this DPA regarding the Client Personal Data, the parties hereby acknowledge and agree that (i) the Clients are the Controllers of the Client Personal Data Processed hereunder, and (ii) Shiji is the Processor of such Client Personal Data.
   Accordingly, Processor agrees that it shall Process all Client Personal Data under the Agreement in accordance with its obligations under this DPA.
4. Controllers warrant in relation to Client Personal Data that it will comply with applicable Data Protection Laws, Controllers shall have the responsibility for the accuracy, quality and legality of Client Personal Data and the means by which Client Personal Data is acquired. Controllers warrant in relation to Client Personal Data that it will comply with applicable Data Protection Laws, Controllers shall have the responsibility for the accuracy, quality and legality of Client Personal Data and the means by which Client Personal Data is acquired.

3. Interpretation and definitions

1. References to clause or clauses are references to the clauses of this DPA unless otherwise stated.
2. Words used in the singular include the plural and vice versa, as the context may require. The word “including” shall in all instances be construed as “including without limitation”.
3. Capitalized terms not defined herein shall have the meaning given under the GDPR, the CCPA or as assigned to such terms in the Agreement, as applicable. Without limitation the foregoing, the terms, “Adequacy Decision”, “Commission”, “Controller”, “Cross-Border Processing”, “Data Subject”, “Data Protection Impact Assessment”, “Member State”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor”, “Special Categories of Personal Data” and “Transfers of Personal Data to Third Countries or International Organizations” shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.
4. For the purpose of the DPA the parties agree on the following meaning to the definitions listed below:
   “Affiliate” shall have the meaning assigned to such term in the Agreement; “Agreement” shall be the Master Services Agreement (as defned in the Gernal Terms and Conditions), and/or the Shiji IT Agreement (as defined in the General Terms and Conditions) and/or have the meaning assigned to such term in General Terms and Conditions;
   “Client Personal Data” means all Personal Data Processed by Shiji and its Affiliates on behalf of Clients or their Affiliates in connection with the Agreement and this DPA, provided that such data is electronic data and information submitted by or for Clients to the Services;
   “Client” means the Client identified in the Agreement. For the purpose of this DPA only, and except where indicated otherwise, the term “Client” shall include Client and its Affiliates;
   “CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1789.100 et seq., and its implementing regulations;
   “Data Protection Laws” means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, Switzerland, the United Kingdom and the United States and its states, applicable to the Processing of Personal Data under the Agreement;
   “GDPR” means the EU General Data Protection Regulation 2016/679;
   ‍“Payment Card Data” shall have the meaning assigned to such term in the Agreement;
   “Participating Hotel” shall have the meaning assigned to such term in the Agreement;
   “Incident response and recovery services” means the collection of actions aimed at identifying, investigating and responding to security incidents in a way that minimizes impact and supports rapid recovery, consisting of the following stages: identification, containment and intelligence, eradication, recovery and lessons learned;
   “Security Incident” is a single or a series of unwanted or unexpected information security events that have a probability of compromising business operations and threatening information security. Security incidents include, but are not limited to; attempts (either failed or successful) to gain unauthorized access to a system or its data; unwanted disruption or denial services; the unauthorized use of a system for the processing or storage of data; changes to system hardware, firmware, or software characteristics without the owner’s knowledge, instruction, or consent;
   “Services” or “Products" means the services provided by Processor to Controller pursuant to the Agreement;
   “Shiji” means the relevant Shiji entity that has agreed to the Agreement. For the purpose of this DPA only, and except where indicated otherwise, the term “Shiji” shall include Shiji and its Affiliates;
   “Sub-processor” means any legal person (including any third party and any Shiji Affiliate) appointed by Processor or any of its Affiliates to Process Client Personal Data in connection with the Agreement;
   “Supervisory Authority” means an independent public authority which is established by an EU Member State pursuant to the GDPR, or in the UK (the ICO) pursuant to the UK Data Protection Act 2018;
   “Third Party” means any non-Shiji provider that as engaged by the Client on the basis of the contractual relationship between the Client and that Third Party to whom Shiji makes the Application Programming Interface (“API”) available.

4. Processing of personal data

1. Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Client’s Personal Data, (i) Client is the Controller, (ii) Shiji is the Processor and that (iii) Shiji may engage Sub-processors pursuant to the requirements set forth in clause 11 “General Authorization for Sub-processors” below.
2. Parties Processing of Personal Data. The parties shall, with respect to the Services, Process Client’s Personal Data in accordance with the Data Protection Laws as directly applicable to each party in the context of the provision and use of the Services. For the avoidance of doubt, Client’s instructions for the Processing of Client’s Personal Data shall comply with applicable Data Protection Laws. Client shall have sole responsibility for the means by which Client acquired Client’s Personal Data. Without limitation, Client shall have any and all required legal bases in order to collect, Process and transfer to Processor the Client’s Personal Data.
3. Controller obligations. The Client as the Controller carries the primary obligation to comply with the Data Protection Laws and to protect Client’s Personal Data. Client agrees to identify applicable legal bases for the Processing Personal Data submitted to Shiji, including when in connection to the disclosure of Client’s Personal Data, Cross-Border Processing, Transfers of Personal Data to Third Countries or International Organisations, Processing of Special Categories of Personal Data as applicable.
4. Processing of Client Personal Data by Processor. Shiji shall treat Client’s Personal Data as Confidential Information (as defined in the Agreement) and, subject to the two last sentences of this paragraph, shall only Process Client’s Personal Data on behalf of its Clients in accordance with Clients’ documented instructions, including with regard to Transfers of Personal Data to Third Countries or International Organizations, for the following purposes: (i) Processing in accordance with the Agreement; (ii) Processing initiated by Client’s end users of the Services; (iii) Processing otherwise required for Clients to be able to provide its services and; (iv) Processing to comply with other documented reasonable instructions provided by Clients (e.g. via e-mail) where such instructions are consistent with the terms of the Agreement. Shiji’s obligation to Process Client’s Personal Data only on the instructions of its Clients in accordance with this clause 4.4. shall be subject to an exception for any Processing by Processor in contravention of, or additional to, such instruction that is required by Data Protection Laws. Where Processor is compelled by Data Protection Laws to Process Client’s Personal Data, Processor shall notify Controller before performing the Processing so compelled unless Data Protection Laws prohibits such notice.
5. Disclosure of Client Personal Data by Processors. The parties acknowledge that Processing of Personal Data includes disclosure of Personal Data that is addressed in clause 4.4. above. For clarity, Processor may disclose Client’s Personal Data to third parties only (a) to the extent required by a court of a competent jurisdiction or other Supervisory Authority and/or otherwise as required by Data Protection Laws or other applicable laws (in such case, Processor shall inform Controller of the legal requirement before the disclosure, unless that law prohibits such notice), or (b) under an obligation of confidentiality to its legal counsel(s), data protection advisor(s) and accountant(s).
6. Written instruction: Shiji, as a Processor, receives written instructions in regards to Client’s Personal Data from its Clients, who are the Controllers of Client Personal Data. This DPA and the Agreement (including any instructions provided by Client via e-mail) are Client's complete and final written instructions at the time of signature of the Agreement for the Processing of Personal Data, where such instructions are consistent with the terms of the Agreement.
7. General cooperation. The nature of the Processing of Client’s Personal Data and information available to Processor shall be taken into account by Controller when providing reasonable cooperation to assist the Controller in the effort to comply with their obligations under Data Protection Laws, including the obligation relating to responding to Data Subject Requests, in ensuring compliance with its obligations with respect to records of processing, security of Processing, notification of Personal Data Breaches, Data Protection Impact Assessment, and consultations with Supervisory Authorities.
8. Data Subject Request to Processor. In the event that Data Subject Request is made directly to Processor, Processor shall respond to such communication informing the Data Subject that any Data Subject Request shall be addressed directly to the Controller. Controllers shall be solely responsible for responding substantively to any such Data Subject Request or communications involving Client’s Personal Data. Shiji will not be liable in the event of any claim brought by a Data Subject, arising from any act or omission of Shiji to the extent that such is a result of Client’s written instruction.
9. Confidentiality. Processor shall ensure that its personnel engaged in the Processing of Client’s Personal Data are informed of the confidential nature of the Client Personal Data and have received appropriate training on their responsibilities.
10. Limitation of Access. Processor shall ensure that its employees’ access to Client’s Personal Data is strictly limited to those personnel requiring such access to perform the Services in accordance with the Agreement.
11. Deletion or Return of Client Personal Data. Upon the expiration or termination of the Agreement, Processor is obligated to delete or return all Client’s Personal Data. This requirement shall not apply to the extent that Processor is required by applicable law to retain some or all of the Client Personal Data.
12. Special Categories of Personal Data. Personal Data provided by Client shall not contain Special Categories of Personal Data, unless the Services are designed to collect such data. In particular, the free text fields available in Shiji’ Services, are not designed for, and shall not be used by the Controller and Client’s end users to record Personal Data, Special Categories of Personal Data and Payment Card Data.

5. Ccpa obligations

1. Capitalized terms as follows (“Business”, “Business Purposes”, “Service Provider”, “Personal Information”) shall have the meaning given under the CCPA.
2. The Client is solely responsible to conduct an analysis to confirm whether they fall within the remit of the CCPA. Where Client falls under the remit of Business under the CCPA, Shiji acts as a Service Provider with respect to the processing of Personal Information of Client’s Personal Data processed solely for the Business Purpose. Business carries the primary responsibility to ensure that the Processing of Personal Information is compliant with the CCPA. Shiji has the following obligations:
   
   1. Shiji will only collect, use, retain, or disclose Personal Information for the contracted Business Purposes as set forth in the Agreement;
   2. Shiji will not retain, use or disclose Personal Information outside of the direct business relationship between Client and Shiji, except as authorized in the Agreement or under the CCPA;
   3. Shiji will not collect, use, retain, disclose, sell, or otherwise make Personal Information available or process Personal Information for Shiji’s own commercial purposes;
   4. Shiji will not engage in any activity that may be considered a Sale of Personal Information pursuant to the CCPA.
3. Where Client does not fall under the remit of the CCPA and/or does not classify as Business under the CCPA, then any data that it sends to a Service Provider (Shiji) should not be impacted by the CCPA.

6. Right to audit

1. Upon Client’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement and this DPA, Processor shall make available to Client information as deemed reasonable and necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits.
2. If an audit identifies that Shiji is failing to comply with any of its obligations under this DPA, without prejudice to other rights of Client, Shiji shall take the necessary steps to comply with its obligations at no additional cost to Client.
3. A third party report or certification provided by Shiji may satisfy the above audit requirements.

7. Personal data breach notification

1. Processor will notify Client without undue delay after becoming aware of Personal Data Breach involving Client’s Personal Data. The notification shall provide reasonable detail with respect to the Personal Data Breach including:
   
   1. A description of the nature of the Personal Data Breach, including where possible, the categories and the approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
   2. Communicate the name and contact details of the Data Protection Officer (DPO) or other contact point where more information can be obtained;
   3. Describe the likely consequences of the Personal Data Breach;
   4. Describe the measures taken or proposed to be taken by the Controller to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
2. Unless required by law, Processor will not notify any third party other than law enforcement of any potential or actual Personal Data Breach involving Client’s Personal Data in any manner that would identify the identify of Client without first obtaining written permission of Client.
3. If Client determines that a Personal Data Breach must be notified to any Supervisory Authority and/or Data Subject and/or public or portions of the public, Client will notify Shiji before the communication is made and supply Shiji with copies of any written documentation to be filed with the Supervisory Authority and of any notification that Client proposes to make which directly or indirectly references Shiji, its security measures and/or role in the Personal Data Breach, whether or not by name.
4. Nothing in this clause shall be construed in such a way as to in any way limit Processor’s ability to engage qualified third parties in the effort to respond to an active Security Incident, to remediate the effects of an incident, to conduct investigations subsequent to an incident or to otherwise comply with its obligations under Data Protection Laws.

8. Access to Shiji “API” by third party

1. Where Client wishes to engage a Third Party, and that Third Party would have access to Shiji Application Programming Interface (“API”), such Third Party entity should contact the authorized Shiji team to enter the relevant process and requirements related to Third Party access. The Client that is the contracting party to the Agreement shall remain responsible for coordinating all communication.
2. Client is solely responsible to ensure that any Third Party follows the Controller’s instructions, maintains confidentiality and takes the necessary security measures regarding the Personal Data Processing.
3. Client agrees to indemnify and hold Shiji harmless against all reasonable losses, damages, liabilities, costs and expenses arising directly out of any Security Incident and/or Personal Data Breach incurred directly as a result of the Third Party access to Shiji API. The above stated indemnity will only apply and Client will only be obligated to indemnify Shiji to the extent such Security Incident and/or Personal Data Breach directly and exclusively causes one or all the following events: (i) engagement of the Incident Response and Recovery services; (ii) Service Level Agreement commitment breach against other Shiji’ Clients.
4. Shiji reserves the right to block the “API” calls in order to protect data confidentiality, integrity and availability, as well as to block any Security Incident attempts.
5. Personal Data Breach pertaining to Personal Data obtained from Shiji API: Where the Security Incident and/or Personal Data Breach occur in the course of the engagement of the Third Party and pertains to Personal Data obtained from the Shiji API, Client agrees to notify Shiji of the Personal Data Breach without undue delay, however not later than within 24 hours after having become aware of the breach. Client agrees to obligate the Third Party to comply with the GDPR (at least to the extent the GDPR affects API access Personal Data Processing), and to provide the complete breach report to the Client as necessary. Breach report must include all information as referred under Art. 33 GDPR. The Client agrees to provide the breach report to Shiji without undue delay, however not later than within 24 hours after receiving it from Third Party.

9. General authorization for sub-processors

1. Appointment of Sub-processors. Client acknowledges and agrees that (a) Shiji Affiliates may be retained as Sub-processors; and (b) Shiji and Shiji Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services.
2. List of current Sub-processors: The list of current Sub-processors is available under the following link: https://www.shijigroup.com/legal/sub-processors-list
3. Notice of new Sub-processors: At least twenty (20) business days before Shiji engages any new Sub-processor, Shiji will update the list of current Sub-processors (available under the link in section above) or otherwise inform Clients of any plans to either add or replace approved Sub-processors.
4. Objection rights for new Sub-processors: Client may reasonably object to new Sub-processors  for reasons related to the Data Protection Laws by notifying Shiji promptly in writing within three (3) business days or within a reasonable amount of time after receipt of Processor notice of new Sub-processors.
5. Agreements with Sub-processors: Processor shall ensure any Sub-processor it engages to provide the Services on its behalf in connection with the Agreement does so only on the basis of a written contract which imposes on such Sub-processor terms substantially no less protective of Personal Data that those imposed on Processor in this DPA.

10. Security measures

1. Controls for the Protection of Client Personal Data. Taking into account the state of art, the costs of implementation and the nature, scope, context and purposes of Processing as well as risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data), confidentiality and integrity of Client Personal Data, including those measures set out in Art. 32 GDPR industry-standard technical and organizational measures required pursuant to Article 32 of the GDPR. Details of the used security measures are available upon request.
2. Where Shiji receives Payment Card Data, these measures shall meet and be equivalent to the security requirements specified by the Payment Card Industry Data Security Standards (PCI Standards).
3. Notwithstanding any provision to the contrary, Processor may modify or update the security measures at its discretion provided that such security measures comply with the Data Protection Laws or the Payment Card Industry Security Standards (PCI Standards).

11. Transfer mechanism for personal data transfers

1. Transfers from EEA to countries that offer adequate level of data protection: Personal Data may be transferred from the EU Member States, the three EEA member countries (Norway, Liechtenstein and Iceland, collectively “EEA”) and Switzerland to countries that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the EEA, the Union, the Member States or the European Commission (“Adequacy Decisions”), without any further safeguard being necessary. Client thereby authorizes any such transfer as described in this clause 11.1. where such transfer of, or access to Personal Data is required in connection with the provisions of Services.
2. Transfers from the UK to the EEA: For Personal Data transferred from the UK to the EEA Article 71(1) of the Withdrawal Agreement applies until full Adequacy Decisions are adopted by the EU and come into effect. Client thereby authorizes any such transfer as described in this clause 11.2. where such transfer of, or access to Personal Data is required in connection with the provision of Services.
3. Transfers from the EEA to other countries: If the Processing of Personal Data includes transfers from the EEA to countries which do not offer adequate level of data protection as per Article 45 GDPR or which have not been subject to an Adequacy Decision (“Other Countries”), the transfer will be subject to other provisions of Chapter V GDPR, including, if necessary, executing the Standard Contractual Clauses (“SCC”). If necessary and applicable, Client and Shiji Affiliates may have to enter into the Standard Contractual Clauses for transfers to Shiji Affiliates in non-EU/EEA countries. Client thereby authorizes any such transfer as described in this clause 11.3. where such transfer of, or access to Personal Data is required in connection with the provision of Services.
4. International transfers of Personal Data: International transfers of Personal Data means transfers outside of the territory from where it was originally disclosed to Shiji (that is not the EEA territory – for transfers from the EEA, see clause 11.1. and 11.3. above). Where the Processing of Personal data includes transfers outside the territory from where it was originally disclosed to Shiji (that is not a EEA territory), Client declares to obtain consent or explicit consent from the Data Subjects for the mentioned transfer of Personal Data on the basis of the applicable Data Protection Laws (except when another legal basis applies). Client thereby authorizes any International transfer of Personal Data where such transfer of, or access to Personal Data is required in connection with the provision of Services.

12. Termination

This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided. Neither of the Parties may terminate this Data Processing Agreement before the Agreement terminates.

13. Data protection officer

Shiji Group appointed a Data Protection Officer (DPO) who may be reached at dpo@shijigroup.com

Contact details of the Client’s DPO or contact point for any data protection matters shall be send without undue delay to dpo@shijigroup.com

14. Modifications

The parties acknowledge and agree that the parties may need to review and amend Annex 1, or include the Standard Contractual Clauses if changes are required for the Processor to continue to process the Personal Data in compliance with the Data Protection Laws. Therefore, the parties should discuss and agree in writing in good faith any amendments required to Annex 1.

15. Limitation of liability

Each party’s and all of its Affiliates’ liability, taken together in the aggregate and applying in the aggregate for all claims, arising out of or related to this DPA, is subject to clause 14 “Limitation of Damages” of the Agreement. For the avoidance of doubt, party’s total liability arising out of o rrelated to this DPA shall not be understood to apply individually and severally to Client and/or to any Client’s Affiliates.

Annex 1 to the DPA - details of the processing

This Annex 1 forms part of Controllers instruction to Processor in connection with Processors Personal Data processing on behalf of the Controller. Any changes (e.g. addition of the AWS Region) under the DPA and this Annex 1 shall be submitted in writing to Shiji.

Nature and Purpose of Processing

Shiji will Process Personal Data as necessary to perform the Services pursuant to the Agreement, as may be further specified under the Order Document, and as further instructed by Client in its use of the Services.

1. Providing the Services to Client.
2. Setting up profile(s) for users authorized by Client.
3. For Client to be able to use the Services.
4. For Processor to comply with documented instructions provided by Client where such instructions are consistent with the terms of this DPA and the Agreement.
5. Performing the Agreement, this DPA and/or other contracts executed by the Parties.
6. Providing support and technical maintenance, if agreed in the Agreement.
7. Resolving disputes
8. Enforcing the Agreement, this DPA.
9. Management of the Agreement, the DPA and/or other contracts executed by the Parties, including fees payment, account administration, accounting, tax, management, litigation; and
10. Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
11. All tasks related with any of the above.

‍

Duration of Processing

Subject to clause 4.11. of this DPA, Shiji will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

Categories of Data Subjects

Client may submit Personal Data to Services, the extent of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data subjects:

• Client’s customers (i.e. Guests) and/or clients
• Client’s users authorized by Client to use the Services
• Employees, agents, advisors, freelancers of Client (who are natural persons)
• Prospects, Clients, business partners and vendors of Client (who are natural persons)
• Employees or contact persons of Client’s prospects, Clients, business partners and vendors
• Any other natural persons authorized by Client to use the Services

‍

Types of Personal Data

Client may submit Personal Data to the Services, the extent to which is determined and controlled by Client in its sole discretion, and which may include, but it is not limited to the following categories of Personal Data.

Basic Personal Data:

• First and last name
• Title and position
• Company name
• Contact information (company, e-mail, physical business address)
• ID, passport details, national insurance numbers, identity card numbers, driving licence details

‍

Personal Data pertaining to reservation data:

• Reservation and booking details (hotel code, room number, check-in/out date, order records, loyalty number, membership status)

Payment Card Data (the following types of Pesronal Data only apply where Shiji’s Payment Products is in scope):

• Credit card number (PAN)
• Credit card expiry date
• Cardholder name
• Full track, CVV/CVC, PIN/PIN block

‍

Special Categories of Personal Data (if appropriate)

In accordance with the restrictions set out in this Agreement, Client smay submit Special Categories of Personal Data to the Services, to the extent of which is determined and controller by Client in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racia or ethnic origin, political opinons, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data, data concerning health or data concerning a natural peron’s sex life or sexual orientation.

Schedule II – confidentiality obligations

1. Both parties expressly undertake to retain in confidence all information and know-how received hereunder or that the other party has identified as being proprietary and/or confidential or that, by the nature of the circumstances surrounding the disclosure, should in good faith be treated as proprietary and/or confidential, and will make no use of such information and know-how except under the terms and during the existence of this Agreement. Notwithstanding the above, either party may disclose Confidential Information as required by governmental or judicial order, provided it gives the other party prompt written notice prior to such disclosure and complies with any protective order (or equivalent) imposed on such disclosure. The parties hereby agree that the terms and conditions of this Agreement shall be treated as confidential information. This provision shall survive termination of the Agreement.
2. "Confidential Information" means:
   any information disclosed by or on behalf of the either party (“Disclosing party”) to the other party (“Receiving party”) during the Term whether disclosed in writing, orally or otherwise that at the time of disclosure:
   
   1. was marked or described as "confidential"; or
   2. should have been reasonably understood by the party providing information to be confidential;
3. Confidentiality Obligations
   1. Each party must:
      
      1. keep the Confidential Information strictly confidential;
      2. not disclose the Confidential Information to any person without the Disclosing party’s prior written consent, and then only under conditions of confidentiality approved in writing by the Disclosing party;
      3. use the same degree of care to protect the confidentiality of the Confidential Information as the Disclosing party uses to protect the Disclosing party’s own confidential information of a similar nature, being at least a reasonable degree of care;
      4. act in good faith at all times in relation to the Confidential Information; and
      5. not use any of the Confidential Information for any purpose other than performing its obligations and/or exercising its rights under this Agreement.
   2. Notwithstanding clause 3.1. of this Schedule II, the Receiving party may disclose the Confidential Information to the Receiving party's officers, employees, professional advisers, insurers, agents and subcontractors who have a need to access the Confidential Information for the performance of their work and who are bound by a written Agreement or professional obligation to protect the confidentiality of the Confidential Information.
   3. This Section 3 of Schedule II imposes no obligations upon either party with respect to Confidential Information that:
      
      1. is known to the Receiving party before disclosure under this Agreement and is not subject to any other obligation of confidentiality;
      2. is or becomes publicly known through no act or default of the Receiving party; or
      3. is obtained by the party from a third party in circumstances where the party has no reason to believe that
      4. there has been a breach of an obligation of confidentiality.
   4. Except in any proceeding to enforce the provisions of this Agreement or except as otherwise required by law, neither party shall publicize or disclose to any third party the existence or provisions of this Agreement or any of the fees, terms or conditions herein, without the prior written consent of the other party. Each party may state that it has an Agreement with the other.
   5. The restrictions in this Section 3 of this Schedule II do not apply to the extent that any Confidential Information is required to be disclosed by any law or regulation, by any judicial or governmental order or request, or pursuant to disclosure requirements relating to the listing of the stock of the party on any recognised stock exchange.

The provisions of this Schedule II shall survive the termination of this Agreement for 5 years.

Schedule III – support and maintenance for hardware

Shiji agrees to supply to the Client, Support and Maintenance for Hardware for the Shiji-branded Hardware products described in the applicable Order Document signed by the Client, subject to the following terms and conditions:

1. Maintenance services covered - Starting on the effective date of the Order Document, and provided the Client is not in default under the Master Services Agreement, Shiji shall provide the Client necessary maintenance services as detailed herein to maintain the equipment listed in Schedule 1 attached to the Order Document signed by the Client, in good working condition, ordinary wear and tear excepted.
2. Standard coverage periods - Each Shiji Maintenance Invoice shall specify the hours during which maintenance services will be supplied to the Client by Shiji. Standard Shiji coverage time periods are per Exhibit 1 attached to the Order Document signed by the Client.
3. Response
   
   1. Response time - If a Shiji service representative's presence is required to perform maintenance on Covered Products hereunder, such service representatives shall exercise reasonable efforts to arrive at the Covered Location on or within the following "Response Time" guidelines:
      "Response Time" is defined as the continuous elapsed time from the Client's contact with Shiji central dispatch and request for on-site services to the arrival time of Shiji service representative at the Covered Location, excluding all elapsed time taking place outside of the scope of this Agreement. If such Response Time would require arrival after the contracted maintenance period, the Client shall have the option of receiving service on or before the response time guidelines as defined herein on the following contracted day or requesting Emergency Service pursuant to Paragraph 5 herein. If services outside the contracted maintenance period, (but otherwise covered under this Agreement), are required due to Shiji’s failure to meet the Response Time Guidelines as specified herein, Shiji shall not invoice the Client for such services.
      ‍
      On Site Response Time Guidelines - By Call Priority Levels and Service Zones as described in Schedule 1 attached to the Order Document or Shiji IT Agreement signed by the Client.
      
      For the purposes of this Agreement, Call Priority Levels shall be defined as shown below:
      
      Call Priority Levels:
      ‍
      Priority Level 1:
      Covered system non-operational. Examples: Primary and backup servers down on a client/server-based system or server down on single-server system, all terminals down, all terminals not communicating to server (server based systems) or themselves (distributed processing systems).
      
      Priority Level 2:
      ‍Partial covered system failure severely affecting the Client operations. Examples: System operational but cannot complete end-of-day, entire revenue centre down, entire remote printer or remote CRT subsystem down, 25% or more of installed terminals down, back office PC down, interface to PMS or other key system not operational.
      
      Priority Level 3:
      ‍Partial system failure moderately affecting the Client operations. Examples: One terminal down, multiple terminals down (but less than 25% of installed terminals), one or more printers down (but not the entire printing subsystem), one or more magnetic card readers down (but less than 25% of installed magnetic card readers).
      
      Priority Level 4:
      System operational with minor difficulty. Examples: Key(s) sticking on keyboard, minor user or the Client display problem, minor printing problem.
      ‍
      Priority Level 5:
      Scheduled services. Examples: Preventative maintenance, equipment installation, equipment relocation, training, re-training, services deferred to a later time or day. Definitions for Zones for the applicable Country are provided at the end of this Schedule.
   2. Zone 3 Response Times.
      ‍In respect of Zone 3, the Client shall either courier the faulty equipment to the nearest Shiji Service Facility or Shiji shall send its service representative with necessary spares to the site. In either case, the Client shall bear all costs (except in cases where the faulty equipment is covered under Shiji’s warranty). If, Shiji is required to send its service representative to the site, Shiji shall charge for the time spent on the Client matter, including (but not limited to) the service representative’s travel time, which Shiji will bill at its then prevailing rate.
   3. Subject to the terms of this Agreement, Shiji shall make reasonable efforts to repair the faulty equipment (Covered Products) within twenty-one (21) working days from the date the subject equipment is received at one of its service facilities.
4. Location of equipment
   ‍The Client understands that the total annual charges are for maintenance services performed at a location specified on the Shiji Maintenance Invoice hereunder (”Covered Location”) and does not include charges associated with relocation, redesign, reinstallation or the Client desired reconfiguration of covered products, or any training charges.
5. Obligations of client
   
   1. The Client will properly render routine attention to the covered products. Routine attention shall include, but is not limited to, the use of paper, ribbons, magnetic cards, and magnetic disc media that meet or exceed Shiji specifications, periodic cleaning of equipment cabinets with a non-abrasive and non-corrosive cleaner, maintaining at least three inches of unrestricted space around covered products to provide for proper air circulation, and keeping all covered products free from harmful materials.
   2. The Client shall at all times maintain the minimum ‘Depot Stock’ at the listed locations, which should be 10% of the installed product base
   3. Shiji shall not be responsible if the Client replaces any parts directly with parts that are not approved by Shiji.
6. Programming modification
   ‍Charges for the development and implementation of program modifications are not included in this Agreement for maintenance services and shall be billed to the Client separately.
7. Initial status of equipment
   ‍If the products have been in operation before coverage by the terms of this Agreement, Shiji may inspect the products at the Client’s expense. The commencement of coverage for these products is contingent upon meeting standard performance and maintenance requirements. If Shiji elects to inspect the equipment, then Shiji will conduct the inspection at the earliest mutual convenience of Shiji and the Client after execution of this Agreement.
8. Exclusions from coverage
   The maintenance services to be provided hereunder do not include labour or parts for repairs made necessary by damage from any cause beyond the control of Shiji, including, but not limited to, damage due to fire, wind, water, storm, riot, vandalism, war, act of God, burglary, power line fluctuations outside of specified norms, accident, negligence or abuse not attributable to Shiji or a Shiji service representative. Shiji specifically excludes repair or damage as a result of servicing by personnel other than Shiji, or its service representative, repair or damage resulting from the failure of the Client to render routine attention to covered products as defined herein, and damages to printer heads or motors resulting from any cause other than normal wear and tear or the presence of foreign objects between the printer head and the print surface. Any repairs resulting from excluded causes or events will be performed only at the Client’s request and only after the Client’s approval of estimated costs for repair submitted by Shiji. There may be other exclusions from coverage contained elsewhere in the Agreement. The Client recognizes that third parties manufacture certain parts and components required to maintain and repair the hardware hereunder, including Shiji proprietary hardware itself. Shiji does not and cannot guarantee the availability of any third-party parts or components, and therefore is not in breach if unable to maintain or repair hardware as a result of the unavailability of any third-party parts or components. Shiji disclaims all liability arising from its reasonable inability to obtain third-party parts or components necessary or appropriate in the repair or maintenance of the hardware hereunder.
9. Performance of maintenance services by Shiji and Shiji representatives
   ‍Definitions for Zones for respective Country would be as described in Schedule 1 to the Order Document signed by the Client.

Schedule IV – Specific Agreement Concerning the Delivery in the European Union

The Agreements in Schedule IV apply to the delivery of Hardware by Shiji to Member States of the European Union.

1. Shiji is entitled to forward the purchase request (for products which have a delivery address within the European Union or the EEA) to a Shiji group company with its registered office in the European Union. The supply contract is concluded between the Client and the aforementioned group company. The product will be delivered by the group company with its registered office in the European Union. The aforementioned group company will send the invoice. The application of the UN-Sales Convention (UN-Kaufrecht) is expressly excluded.
2. Currency: The agreed invoicing currency is in Euro, unless there is a specific agreement between the parties. The Currency conversion is based on the exchange rate on the day of the invoice. EURO <-> National currency.
3. Product liability. The provisions of the European Product Liability Directive shall apply.
4. Warranty. Both contract parties are entrepreneurs. The contract parties have concluded a guarantee agreement. The contract parties herewith jointly exclude the statutory warranty.
5. Value added tax. The Client declares to be a company, which will be evidenced by a tax number. The contract will only be concluded if the Client discloses such tax number. If the Client is located in same European Union Country as Shiji, the invoice will include the statutory sales tax. If the Client is located in another European Union country, the invoice will be raised net of tax as intra community service provision and will be marked as reverse charge. If the Client is located in a non-EU-country and if the service is not tax- relevant in European Union Country of Shiji, the invoice will not include VAT, however it will be marked as reverse charge, provided that the legal requirements are met, and the Client has submitted a “Certificate of Business-Registration” to Shiji. The Client is obligated to pay VAT if a tax inspection proves that the transaction is taxable. If the Client has not submitted a valid “Certificate of Business-Registration” and/or a valid VAT-Number, the statutory sales tax will be included on the invoice.
6. Withholding Taxes. National Withholding Taxes, also called retention taxes, will be borne by the Client in addition to the invoice amount. The Client is not entitled to deduct the Withholding Tax from the invoice amount. For example: The invoice amount is EUR 100. In accordance with the national tax regulations which are applicable for the Client, a Withholding Tax in the amount of 10% has to be paid. The Client has to pay the full invoice amount (EUR 100) to Shiji and the Withholding tax in the amount of EUR 10 to the relevant tax authority.
7. Additional import costs. If nothing else has been agreed between the contracting parties, the additional import costs shall be borne by the Client. Additional import costs are shipping costs, Duty (starting from a goods value of EUR 150) and import turnover-tax (starting from a goods value of EUR 22).
8. The “Data Processing Agreement” that constitute the part of this “Agreement” are applicable.