3V POS — TERMS OF USE

Operated by: THREE V ANALYTICS (Registration No. 202603168152 (003864392-D))

Effective Date: 01 August 2026 Version: 1.0 Last updated: 01 August 2026

IMPORTANT — READ BEFORE USING

These Terms of Use ("Terms") form a legally binding contract between you and Three V Analytics. By creating an account, clicking "I agree", installing the App, paying a Subscription Fee, or otherwise accessing or using 3V POS, you agree to be bound by these Terms and by the 3V POS Privacy Policy, which is incorporated into these Terms by reference.

If you are agreeing to these Terms on behalf of a company, partnership, sole proprietorship or other entity, you represent that you are duly authorised to bind that entity, and "you" and "Merchant" refer to that entity.

If you do not agree to these Terms, do not use the Service.

Clause 14 (Limitation of Liability), Clause 15 (Indemnity) and Clause 21 (Governing Law and Dispute Resolution) limit our liability and affect your legal rights. Please read them carefully.

1. DEFINITIONS AND INTERPRETATION

1.1 In these Terms, unless the context otherwise requires:

"App" means the 3V POS mobile and/or tablet application (including any Android, iOS or web-based version) made available by us.

"Business Day" means a day other than Saturday, Sunday or a public holiday gazetted in Malaysia.

"Confidential Information" has the meaning given in Clause 16.

"End-Customer" means an individual who transacts with, orders from, or otherwise deals with a Merchant using or through the Service (including via QR self-ordering).

"Fees" means Subscription Fees and any other charges payable under these Terms.

"Merchant" / "you" means the person or entity that registers for or uses the Service.

"Merchant Data" means all data, records and content entered into, generated by, uploaded to, or processed through the Service by or on behalf of the Merchant, including menu and inventory records, order and transaction records, receipts, staff records, pricing and tax configurations, and End-Customer personal data.

"PDPA" means the Personal Data Protection Act 2010 (Act 709) of Malaysia, as amended (including by the Personal Data Protection (Amendment) Act 2024), together with all subsidiary legislation, standards, circulars and guidelines issued under it.

"Service" means the 3V POS point-of-sale software-as-a-service platform, comprising the App, the merchant back-office/dashboard, the kitchen display system (KDS), QR self-ordering, reporting and analytics functions, related APIs, updates and documentation, and any support services we provide.

"Subscription Fee" means the recurring fee payable for the Service in accordance with your selected plan.

"Subscription Term" means the billing period (monthly, annual or as otherwise stated at sign-up) for which you have subscribed.

"we", "us", "our", "3V" means Three V Analytics, its successors and permitted assigns.

1.2 Headings are for convenience only and do not affect interpretation. Words importing the singular include the plural and vice versa. "Including" means "including without limitation". A reference to a statute includes that statute as amended or re-enacted.

1.3 If there is any conflict between these Terms and a separately signed written agreement between you and us, the signed agreement prevails to the extent of the conflict. If there is any conflict between the body of these Terms and Schedule 1 (Data Processing Addendum) in relation to the processing of personal data, Schedule 1 prevails.

2. ELIGIBILITY AND ACCOUNTS

2.1 Eligibility. The Service is offered for business use only. You must be at least 18 years old and legally capable of entering into a binding contract under the Contracts Act 1950. You must be a business operating lawfully in Malaysia (or such other jurisdiction as we may expressly approve in writing).

2.2 Registration. You must provide accurate, current and complete information when registering, and keep it updated. We may refuse, suspend or terminate any registration at our discretion where information is false, incomplete or misleading.

2.3 Account security. You are responsible for all activity under your account, including activity by your staff, outlet users and PIN holders. You must keep login credentials, PINs and device access secure, and notify us immediately at team@3vanalytics.com on becoming aware of any unauthorised access. We are not liable for loss arising from your failure to safeguard credentials or devices.

2.4 Staff and outlet users. You are responsible for ensuring that every person you authorise to use the Service does so in compliance with these Terms, and you are liable for their acts and omissions as if they were your own.

2.5 Verification. We may require verification of your identity, business registration (SSM), bank account or tax status before activating or continuing the Service, and may suspend the Service pending satisfactory verification.

3. GRANT OF RIGHTS AND SCOPE OF SERVICE

3.1 Licence. Subject to your continuing compliance with these Terms and payment of all Fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to access and use the Service for your internal business operations at the outlets and on the number of devices or user seats covered by your plan, during the Subscription Term.

3.2 No sale. The Service is licensed, not sold. All rights not expressly granted are reserved to us.

3.3 Plan limits. Features, outlet counts, device or user limits, transaction volumes, data retention periods and storage allowances are as set out in your plan at https://www.3vanalytics.com/3vpos or in your subscription confirmation. Exceeding plan limits may result in additional charges, throttling or feature restriction, on prior notice where practicable.

3.4 Changes to the Service. We may modify, add to, or discontinue features of the Service. Where a change materially reduces core functionality of your paid plan, we will give you at least thirty (30) days' prior notice by email or in-app notice, and you may terminate under Clause 12.3 and receive a pro-rated refund of prepaid Fees for the unexpired period.

3.5 Trials and beta features. Free trials, pilot deployments and features marked "beta", "preview" or "early access" are provided as is, may be withdrawn at any time, and are excluded from any service commitments, credits or warranties under these Terms to the maximum extent permitted by law.

4. MERCHANT RESPONSIBILITIES

4.1 Equipment and connectivity. You are responsible, at your own cost, for compatible devices, printers, cash drawers, peripherals, electricity, internet connectivity and their maintenance. We do not warrant compatibility with any particular hardware unless expressly stated in writing.

4.2 Configuration accuracy. You are solely responsible for the accuracy of all configurations you enter, including menu items, prices, discounts, vouchers, service charge rates, rounding settings, tax codes, tax rates and receipt particulars. We do not verify and are not responsible for the correctness of your tax, pricing or receipt configuration.

4.3 Tax and regulatory compliance. You are solely responsible for your own compliance with all laws applicable to your business, including:

(a) the Sales Tax Act 2018 and Service Tax Act 2018 and related regulations administered by the Royal Malaysian Customs Department (RMCD), including registration where thresholds are met, correct rate application, service charge treatment and rounding; (b) e-Invoice requirements administered by the Inland Revenue Board of Malaysia (LHDN/MyInvois), including determining whether and when they apply to you; (c) the Food Act 1983, Food Hygiene Regulations 2009, local authority licensing, weights and measures, and price display requirements; (d) the Consumer Protection Act 1999 and the Price Control and Anti-Profiteering Act 2011; and (e) the PDPA, in respect of End-Customer and staff personal data you collect.

4.4 No professional advice. The Service, its reports, and any tax, accounting, compliance or analytical output are provided for operational convenience only. They do not constitute tax, accounting, legal or financial advice, and must not be relied on as such. You should verify all figures and obtain independent professional advice. Any reference to the Service assisting with SST, e-Invoice or LHDN readiness is descriptive of functionality only and is not a warranty of compliance.

4.5 Records. You are responsible for maintaining your own statutory books and records for the periods required by law (including under the Income Tax Act 1967 and the Companies Act 2016). Do not rely on the Service as your sole system of record. You should export and retain your own copies of transaction data regularly.

4.6 Lawful use. You must not use the Service in connection with any illegal, fraudulent or prohibited activity, or for any goods or services you are not licensed to sell.

5. OFFLINE OPERATION AND DATA SYNCHRONISATION

5.1 The Service includes offline-first functionality that allows transactions to be recorded on a device without an active internet connection and synchronised to our servers when connectivity is restored.

5.2 You acknowledge and accept that:

(a) data recorded offline exists only on that device until synchronisation completes, and may be permanently lost if the device is lost, stolen, damaged, reset, uninstalled, or if local storage is cleared before synchronisation; (b) reports, dashboards, stock levels and consolidated figures may be incomplete or inconsistent while any device remains unsynchronised; (c) where the same records are edited on more than one device, conflict-resolution rules apply and the outcome may not reflect every edit; and (d) you are responsible for ensuring devices are synchronised regularly and before end-of-day closing, reporting or stock reconciliation.

5.3 To the maximum extent permitted by law, we are not liable for any loss, corruption or inconsistency of data arising from unsynchronised devices, device failure, device disposal, uninstallation, or your failure to synchronise.

6. FEES, BILLING AND PAYMENT

6.1 Fees. You must pay the Subscription Fees and any other charges for your plan, together with any applicable onboarding, setup, hardware, training or support fees notified to you.

6.2 Taxes. All Fees are exclusive of service tax, sales tax and any other government-imposed taxes, levies or duties, which will be added and payable by you at the prevailing rate where applicable. Where we are or become a registered person under the Service Tax Act 2018, service tax will be charged on taxable Fees at the prevailing rate. If you are required to withhold any amount by law, you must gross up so that we receive the full invoiced amount.

6.3 Billing cycle. Subscriptions are billed in advance for each Subscription Term. Unless cancelled in accordance with Clause 12.2.

6.4 Payment methods and mandates. Payment may be collected by direct debit / e-mandate (including FPX e-Mandate via our payment gateway partner), online banking transfer, DuitNow, card, or such other methods as we make available. Where you set up a mandate, you authorise recurring debits of Fees from the nominated account until the mandate is cancelled, and you must ensure sufficient funds are available on each due date.

6.5 Due date and late payment. Invoices are payable by the date stated on the invoice or, if none, within fourteen (14) days. Overdue amounts may attract late payment interest of 1.5% per month (or part month) calculated on a daily basis from the due date until payment in full, and we may recover reasonable costs of collection, including legal costs on a solicitor-and-client basis.

6.6 Suspension for non-payment. If any amount remains unpaid for more than seven (7) days after the due date, we may, after giving you notice, suspend or restrict your access to the Service until all outstanding amounts are paid. Fees continue to accrue during suspension.

6.7 Price changes. We may revise Fees on not less than thirty (30) days' prior notice, effective from your next Subscription Term. If you do not accept the revised Fees, you may terminate before the change takes effect under Clause 12.2.

6.8 No refunds. Except as expressly stated in these Terms or as required by law, all Fees are non-refundable, including for partial periods, unused features, outlet closures, or periods of suspension caused by your breach. This clause does not exclude any refund right you may have as a "consumer" under the Consumer Protection Act 1999 where that Act applies.

6.9 Third-party payment processing. Where the Service enables you to accept payments from End-Customers via a third-party payment gateway, e-wallet or acquirer, that service is provided under a separate contract between you and that provider. We are not a party to it, do not hold or settle those funds, and are not responsible for settlement timing, chargebacks, disputes, fees or failures of that provider.

7. ACCEPTABLE USE

7.1 You must not, and must not permit any person to:

(a) copy, modify, translate, adapt, decompile, disassemble or reverse engineer any part of the Service, except to the extent expressly permitted by law; (b) rent, lease, resell, sublicense, distribute, time-share or otherwise make the Service available to any third party, other than as expressly authorised by us in writing; (c) access the Service to build, train or benchmark a competing product or service, or to extract data for that purpose; (d) use bots, scrapers, crawlers or automated means to access, copy or harvest data from the Service beyond documented APIs; (e) circumvent or attempt to circumvent any access controls, plan limits, licence keys, device limits or security measures; (f) upload or transmit any malware, or any content that is unlawful, obscene, defamatory, infringing or that violates any person's rights; (g) impose an unreasonable or disproportionately large load on our infrastructure, or interfere with the integrity or performance of the Service; (h) use the Service to send unsolicited commercial messages in breach of applicable law; or (i) process personal data through the Service in breach of the PDPA or without a lawful basis.

7.2 We may investigate any suspected breach and may suspend access immediately where we reasonably believe there is a risk to the security, integrity or lawful operation of the Service or to other users.

8. INTELLECTUAL PROPERTY

8.1 Our IP. We and our licensors own all right, title and interest in and to the Service, including all software, source code, object code, databases, interfaces, designs, documentation, and the marks "3V POS", "3V Analytics" and "Three V Analytics", and all associated intellectual property rights. Nothing in these Terms transfers any of those rights to you.

8.2 Your data. As between you and us, you retain all right, title and interest in Merchant Data. You grant us a non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, display, process and otherwise use Merchant Data solely to the extent necessary to provide, secure, maintain, support and improve the Service, to comply with law, and as otherwise permitted under Schedule 1.

8.3 Aggregated and anonymised data. We may generate statistical, aggregated and de-identified data derived from use of the Service (for example, industry benchmarks and product analytics), provided that such data does not identify you, any End-Customer or any individual, and cannot reasonably be used to do so. We own such aggregated data and may use and disclose it for any lawful business purpose, including benchmarking, product development and marketing.

8.4 Feedback. If you provide suggestions, feature requests or feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free right to use and incorporate them without obligation, attribution or compensation.

8.5 Your marks. You grant us a limited licence to use your business name and logo (i) within the Service to render your receipts, QR ordering pages and dashboards, and (ii) to identify you as a customer in our marketing, subject to your right to withdraw consent for (ii) at any time by written notice.

9. THIRD-PARTY SERVICES AND HARDWARE

9.1 The Service may interoperate with third-party services and products, including cloud hosting and database providers, payment gateways, messaging providers, app stores, receipt printers and other peripherals.

9.2 Third-party services are provided subject to those third parties' own terms and privacy policies. We do not control them, do not endorse them, and are not responsible or liable for their availability, performance, accuracy, security, pricing or acts and omissions.

9.3 If a third-party service is changed, degraded, withdrawn or becomes commercially unreasonable for us to continue using, we may modify or discontinue the related functionality of the Service on reasonable notice, without liability.

10. SERVICE AVAILABILITY AND SUPPORT

10.1 We will use commercially reasonable efforts to keep the hosted components of the Service available, but we do not warrant that the Service will be uninterrupted, error-free, or that all defects will be corrected.

10.2 The Service may be unavailable during (a) scheduled maintenance, for which we will use reasonable efforts to give advance notice and to schedule outside typical peak trading hours; (b) emergency maintenance; and (c) any Force Majeure Event or failure of a third-party provider, telecommunications network or power supply.

10.3 Support is provided during Monday to Friday, 9.00am to 6.00pm (MYT), excluding public holidays via team@3vanalytics.com or WhatsApp at (+60) 17-465 0432, with target response times as published from time to time. Support targets are objectives, not contractual guarantees, unless set out in a separately signed service level agreement.

10.4 Support excludes issues caused by your hardware, network, third-party software, misuse, unauthorised modification, or use of the Service other than in accordance with our documentation. We may charge our then-current rates for support of such issues, on prior notice.

11. DATA PROTECTION, BACKUP AND EXPORT

11.1 Each party will comply with the PDPA in relation to its processing of personal data in connection with the Service. The parties' respective roles and obligations are set out in Schedule 1 (Data Processing Addendum), which forms part of these Terms.

11.2 In summary, and as further described in Schedule 1: (a) we act as data controller in respect of your business account, billing and support data; and (b) we act as data processor on your instructions in respect of End-Customer and staff personal data that you process through the Service, for which you are the data controller.

11.3 Backups. We maintain routine backups of hosted Merchant Data as part of our operational practices. Backups are a disaster-recovery measure for the platform and are not a substitute for your own record-keeping. You are responsible for exporting and retaining your own copies of transaction and accounting records.

11.4 Export on termination. For thirty (30) days after termination or expiry, you may export Merchant Data in the formats then supported by the Service (for example CSV). After that period, we may delete Merchant Data from active systems, and from backups in accordance with our backup rotation cycle, except where retention is required by law. We may withhold export assistance while any Fees remain overdue.

12. SUSPENSION, TERMINATION AND CONSEQUENCES

12.1 Suspension. We may suspend all or part of the Service immediately where: (a) Fees are overdue (Clause 6.6); (b) we reasonably suspect a breach of Clause 7; (c) suspension is necessary to protect the security or integrity of the Service or other users; or (d) required by law or by a regulator, court or law enforcement authority.

12.2 Termination by you. You may terminate by cancelling your subscription through the App or by written notice to team@3vanalytics.com not less than seven (7) days before the end of the then-current Subscription Term. Termination takes effect at the end of that Subscription Term, and no refund is payable for the remainder of that term except as provided in Clause 3.4 or as required by law.

12.3 Termination by either party for cause. Either party may terminate immediately by written notice if the other party: (a) commits a material breach that is not remediable, or that is remediable but is not remedied within fourteen (14) days of written notice; or (b) becomes insolvent, has a receiver, liquidator or administrator appointed, enters into a scheme or arrangement with creditors, ceases or threatens to cease carrying on business, or is subject to any analogous event.

12.4 Termination by us for convenience. We may terminate the Service on thirty (30) days' written notice, in which case we will refund the pro-rated portion of any prepaid Fees for the unexpired period as your sole remedy.

12.5 Effect of termination. On termination or expiry: (a) all licences granted to you cease immediately and you must stop using the Service; (b) all accrued Fees become immediately due; (c) Clause 11.4 applies to data export and deletion; and (d) Clauses 1, 4.3–4.5, 6 (in respect of accrued amounts), 8, 11.4, 13, 14, 15, 16, 21 and 22, and Schedule 1 where applicable, survive termination.

13. WARRANTIES AND DISCLAIMERS

13.1 Each party warrants that it has full power and authority to enter into and perform these Terms.

13.2 You warrant that: (a) all information you provide is accurate; (b) you have all necessary rights, consents and lawful bases for Merchant Data processed through the Service, including notice to and (where required) consent from End-Customers and staff under the PDPA; and (c) your use of the Service complies with all applicable laws.

13.3 Disclaimer. Except as expressly stated in these Terms, and to the maximum extent permitted by law, the Service is provided "as is" and "as available", and we exclude all other terms, conditions, warranties and representations, whether express, implied, statutory or otherwise, including any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, accuracy, non-infringement, and uninterrupted or error-free operation.

13.4 We do not warrant that the Service will meet your requirements, that reports or calculations generated by the Service will be accurate or sufficient for tax, accounting or regulatory purposes, or that the Service will make your business compliant with any law.

13.5 Statutory rights preserved. Nothing in these Terms excludes, restricts or modifies any guarantee, condition, warranty, right or remedy that is implied or imposed by law and that cannot lawfully be excluded, restricted or modified, including under the Consumer Protection Act 1999 (where it applies to you) and the Sale of Goods Act 1957. Where such a term is implied and cannot be excluded, our liability for breach is limited, to the extent permitted by law, to re-supplying the Service or paying the cost of having the Service re-supplied.

14. LIMITATION OF LIABILITY

14.1 Excluded losses. To the maximum extent permitted by law, neither party is liable to the other for any: loss of profit, loss of revenue, loss of anticipated savings, loss of business or business opportunity, loss of goodwill or reputation, loss of or corruption of data (except as set out in Clause 14.2), business interruption, or any indirect, special, incidental, consequential or punitive loss, in each case however caused, whether in contract, tort (including negligence), breach of statutory duty or otherwise, and whether or not the party was advised of the possibility of such loss.

14.2 Liability cap. To the maximum extent permitted by law, our total aggregate liability arising out of or in connection with these Terms and the Service, whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise, is limited to the total Fees actually paid by you to us for the Service in the twelve (12) months immediately preceding the first event giving rise to the claim, or RM1,000.00, whichever is the higher.

14.3 Carve-outs. Nothing in these Terms limits or excludes either party's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; (c) your obligation to pay Fees; (d) breach of Clause 8.1 (our intellectual property); (e) liability under Clause 15 (Indemnity); or (f) any liability that cannot lawfully be limited or excluded.

14.4 Allocation of risk. You acknowledge that the Fees reflect the allocation of risk in these Terms, and that we would not provide the Service at those Fees without these limitations. You are responsible for maintaining your own business continuity arrangements, including a manual fallback procedure for taking orders and issuing receipts during any outage.

14.5 Claims period. To the maximum extent permitted by law, any claim arising out of or in connection with these Terms must be brought within one (1) year after the claimant became aware, or ought reasonably to have become aware, of the facts giving rise to the claim.

15. INDEMNITY

15.1 You will indemnify, defend and hold harmless us, our related corporations, and our respective directors, officers, employees and agents, against all claims, demands, actions, proceedings, losses, liabilities, damages, fines, penalties, costs and expenses (including reasonable legal costs) arising out of or in connection with:

(a) your breach of these Terms or of any applicable law; (b) Merchant Data, including any claim that Merchant Data infringes third-party rights or was collected, used or disclosed unlawfully; (c) any claim by an End-Customer, your staff, your suppliers or any regulator relating to your business, your goods or services, your pricing, your receipts, your tax treatment, or your handling of personal data; and (d) your negligence, wilful misconduct or fraud.

15.2 We will notify you promptly of any claim to which this indemnity applies, allow you to control the defence (provided that no settlement admitting liability on our part or imposing obligations on us is made without our prior written consent), and provide reasonable assistance at your cost.

16. CONFIDENTIALITY

16.1 "Confidential Information" means non-public information disclosed by one party to the other that is identified as confidential or that would reasonably be understood to be confidential, including pricing, product roadmaps, technical information, Merchant Data and business records.

16.2 Each party must keep the other's Confidential Information confidential, use it only for the purposes of these Terms, and disclose it only to personnel and professional advisers who need to know it and are bound by equivalent obligations.

16.3 These obligations do not apply to information that is or becomes public other than by breach, was lawfully known before disclosure, is independently developed, or is lawfully received from a third party. A party may disclose Confidential Information to the extent required by law, regulation, court order or a regulator, giving the other party prior notice where lawfully permitted.

16.4 These obligations continue for three (3) years after termination, and indefinitely in respect of personal data and trade secrets.

17. FORCE MAJEURE

17.1 Neither party is liable for any failure or delay in performing its obligations (other than payment obligations) to the extent caused by an event beyond its reasonable control, including act of God, flood, fire, earthquake, epidemic or pandemic, war, terrorism, riot, civil commotion, strike or labour dispute, governmental order, change in law, nationwide or regional power failure, telecommunications or internet backbone failure, cyber-attack (including denial-of-service), or failure of a third-party hosting or payment provider ("Force Majeure Event").

17.2 The affected party must notify the other as soon as practicable and use reasonable efforts to mitigate. If a Force Majeure Event continues for more than sixty (60) consecutive days, either party may terminate on written notice, and we will refund the pro-rated prepaid Fees for the unused period.

18. CHANGES TO THESE TERMS

18.1 We may amend these Terms from time to time. We will publish the amended Terms at https://www.3vanalytics.com/3vpos/terms-of-use and update the "Last updated" date.

18.2 For material amendments, we will give you at least fourteen (14) days' prior notice by email to your registered address or by in-app notice.

18.3 Your continued use of the Service after the effective date of an amendment constitutes acceptance. If you do not accept a material amendment, your sole remedy is to terminate under Clause 12.2 before it takes effect, in which case we will refund the pro-rated prepaid Fees for the unexpired period.

19. NOTICES AND ELECTRONIC COMMUNICATIONS

19.1 Notices to us must be sent to team@3vanalytics.com and marked for the attention of HL Phoon.

19.2 Notices to you may be given by email to your registered account email, by in-app notification, or by post to your registered business address, and are deemed received: (a) if by email or in-app, on transmission (or the next Business Day if sent outside business hours); (b) if by courier, on delivery; and (c) if by registered post, three (3) Business Days after posting.

19.3 You consent to receive all communications, agreements, notices, invoices and receipts electronically. In accordance with the Electronic Commerce Act 2006 and the Digital Signature Act 1997, the parties agree that electronic records and electronic acceptance (including clicking "I agree") satisfy any legal requirement for writing and signature, and shall not be denied legal effect solely because they are in electronic form.

20. GENERAL

20.1 Assignment. You may not assign or novate these Terms without our prior written consent. We may assign or novate these Terms to a related corporation or in connection with a merger, reorganisation or sale of all or substantially all of our assets, on notice to you.

20.2 Subcontracting. We may subcontract or use third-party providers to perform any of our obligations, and remain responsible for their performance of those obligations.

20.3 Independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, franchise or employment relationship between the parties.

20.4 No third-party rights. These Terms are for the benefit of the parties only. Save as expressly stated, no third party has any right to enforce any provision of these Terms.

20.5 Entire agreement. These Terms (including the Privacy Policy and Schedule 1) constitute the entire agreement between the parties in relation to the Service and supersede all prior discussions, proposals, brochures, demonstrations and representations. Each party agrees that it has not relied on any statement not set out in these Terms, but nothing limits liability for fraudulent misrepresentation.

20.6 Severability. If any provision is held invalid, illegal or unenforceable, it is to be read down to the minimum extent necessary, or severed, and the remaining provisions continue in full force.

20.7 Waiver. No failure or delay in exercising a right is a waiver of it. A waiver is effective only if in writing.

20.8 Cumulative remedies. The rights and remedies in these Terms are cumulative and not exclusive of any rights or remedies at law.

20.9 Language. These Terms may be issued in English and Bahasa Malaysia. In the event of any inconsistency, the English version prevails, save where applicable law requires otherwise.

20.10 Anti-bribery and sanctions. Each party will comply with the Malaysian Anti-Corruption Commission Act 2009 (including section 17A) and all applicable anti-bribery, anti-money laundering and sanctions laws.

21. GOVERNING LAW AND DISPUTE RESOLUTION

21.1 These Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes) are governed by and construed in accordance with the laws of Malaysia.

21.2 Escalation. Before commencing proceedings, the parties will use reasonable efforts to resolve any dispute by good-faith negotiation between senior representatives within thirty (30) days of written notice of the dispute.

21.3 Jurisdiction. The parties submit to the exclusive jurisdiction of the courts of Malaysia, and the parties agree that the courts at Penang shall be the appropriate forum.

21.4 Nothing in this Clause prevents either party from seeking urgent interim or injunctive relief from any court of competent jurisdiction.

21.5 Nothing in this Clause prevents us from bringing proceedings to recover unpaid Fees in any court of competent jurisdiction.

22. CONTACT

THREE V ANALYTICS (Registration No.: 202603168152 (003864392-D))

Email: team@3vanalytics.com

Phone Number: (+60) 17-465 0432

Address: No.1, Education Boulevard Batu Kawan Industrial Park, 14110 Batu Kawan, Pulau Pinang, Malaysia.


SCHEDULE 1 — DATA PROCESSING ADDENDUM (DPA)

This Schedule forms part of the Terms of Use and applies where we process personal data on your behalf in connection with the Service. Terms defined in the Terms have the same meaning here. "Personal data", "sensitive personal data", "data controller", "data processor", "data subject" and "processing" have the meanings given in the PDPA.

1. Roles of the parties

1.1 In respect of End-Customer personal data, staff and outlet-user personal data, and any other personal data you place into the Service, you are the data controller and we are the data processor, processing only on your documented instructions.

1.2 In respect of your business account owner and administrator details, billing information, support correspondence, and platform security and usage logs, we act as data controller and process such data in accordance with the 3V POS Privacy Policy.

1.3 Your instructions to us are: (a) these Terms and this Schedule; (b) your configuration of the Service; and (c) any further written instruction agreed by us. We will notify you if, in our reasonable opinion, an instruction infringes the PDPA.

2. Your obligations as controller

2.1 You warrant that you have: (a) a lawful basis for the processing, including consent where required under section 6 PDPA; (b) issued a compliant privacy notice to your End-Customers and staff, in Bahasa Malaysia and English as required by section 7(2) PDPA; and (c) not instructed us to process any personal data unlawfully.

2.2 You must not enter into the Service any sensitive personal data (as defined in the PDPA, including health, biometric, religious, political and criminal-record data) unless expressly agreed with us in writing, and unless you have obtained explicit consent where required.

2.3 You must not enter full payment card numbers, CVV/CVC codes, or any other cardholder authentication data into free-text fields of the Service. The Service is not designed as a cardholder data environment.

2.4 You are responsible for responding to data subject requests and complaints from your End-Customers and staff, and for your own breach notification obligations under section 12B PDPA.

3. Our obligations as processor

3.1 We will process personal data only on your documented instructions and for the purposes of providing, securing, maintaining, supporting and improving the Service, and as required by law.

3.2 We will implement and maintain appropriate technical and organisational security measures having regard to the nature of the data and the harm that would result from unauthorised access, including: encryption of data in transit (TLS) and at rest; role-based access control and least-privilege administrative access; tenant-level data segregation; authentication controls; logging and monitoring; routine backups; vulnerability management; and access reviews.

3.3 We will ensure that personnel authorised to process personal data are subject to obligations of confidentiality and receive appropriate data protection training.

3.4 We will assist you, at your cost where the assistance is more than trivial, with: (a) responding to data subject requests (access, correction, withdrawal of consent, limiting processing, and data portability); (b) security, breach notification and data protection impact assessments; and (c) enquiries from the Personal Data Protection Commissioner.

3.5 Breach notification. We will notify you without undue delay, and in any event within twenty-four (24) hours of becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide the information reasonably available to us to enable you to assess and, where required, notify the Commissioner within seventy-two (72) hours and to notify affected data subjects where the breach causes or is likely to cause significant harm.

3.6 Sub-processors. You give general authorisation for us to engage sub-processors, including cloud hosting, database, communications, analytics and payment infrastructure providers. A current list is available on request from team@3vanalytics.com. We will impose data protection obligations on each sub-processor no less protective than those in this Schedule, and remain liable for their performance. We will give you at least thirty (30) days' notice of any new or replacement sub-processor; if you reasonably object on data protection grounds, we will use reasonable efforts to offer an alternative, failing which you may terminate the affected Service and receive a pro-rated refund of prepaid Fees.

3.7 Cross-border transfer. Personal data may be stored or processed outside Malaysia by our hosting providers and sub-processors. Any such transfer will be made in accordance with section 129 PDPA and the Commissioner's Guidelines for Cross Border Personal Data Transfer, on the basis that the recipient jurisdiction provides a comparable level of protection, or that appropriate safeguards (including contractual clauses) and a transfer impact assessment are in place. Details of primary hosting locations are available on request.

3.8 Deletion and return. On termination, we will delete or, at your written request made within thirty (30) days of termination, return personal data processed on your behalf, in accordance with Clause 11.4 of the Terms, except where retention is required by law.

3.9 Audit. On not less than thirty (30) days' written notice, no more than once in any twelve (12) month period (and additionally following a confirmed personal data breach affecting your data), we will provide information reasonably necessary to demonstrate compliance with this Schedule. Where you require an on-site or third-party audit, it must be conducted during business hours, subject to confidentiality, without disrupting our operations, and at your cost.

4. Liability

4.1 The limitations and exclusions of liability in Clause 14 of the Terms apply to this Schedule, save to the extent that liability cannot lawfully be limited under the PDPA.