SUFRA MERCHANT TERMS AND CONDITIONS

Version 1.1 — Effective 14 September 2026

Version 1.1 - Effective 14 September 2026

Agreement between Sufra Technology W.L.L., CR No. 233626, Building 15, Street 2322, Zone 51, Floor 2, Qatar Science & Technology Park, Doha, State of Qatar ("Sufra") and the restaurant or merchant identified in the applicable Order Form ("Merchant", "you").

By signing an Order Form or completing an electronic acceptance process made available by Sufra, an authorised representative accepts these Terms for and on behalf of the Merchant. Electronic records and electronic signatures shall have effect to the extent they satisfy Decree-Law No. 16 of 2010 on Electronic Transactions and Commerce, including the evidential requirements applicable to electronic signatures.

1. DEFINITIONS

Order of precedence on conflict: (1) a separately signed Restaurant Platform Services Agreement, if any; (2) the Data Protection Annex, but only for personal data matters; (3) the Order Form and Fee Schedule for the Modules, Branches and commercial terms expressly completed there; and (4) these Terms. A purchase order, vendor-onboarding form or other Merchant document does not amend the Agreement unless Sufra expressly signs the amendment.

2. ACCOUNTS

2.1 You represent and warrant on acceptance and throughout the Agreement that you are duly incorporated or otherwise legally established in Qatar, maintain a valid commercial registration, trade licence and every Ministry of Public Health, municipality and other approval required for each Branch and activity, and that your business is conducted in accordance with Applicable Law. You are solely responsible for any violation, suspension, fine, closure or restriction relating to your business, premises, food, licences, Personnel or operations. Notify Sufra within two (2) Business Days of any expiry, suspension, cancellation or material restriction, and within five (5) Business Days of any other material change to your registration, name, ownership, authorised signatory, Branch address or billing details.

2.2 Individual logins only no shared or generic credentials. Revoke a user’s access the same day they leave. Report suspected unauthorised access within 24 hours.

2.3 You are liable for your Personnel’s acts and omissions as if they were your own. Sufra may suspend an individual user without suspending your wider access.

3. THE MODULES

You receive only the Modules listed in the Order Form, only at the Branches listed.

3.1 POS connection read-only. Sufra reads transaction data from your POS on a read-only basis, solely to generate analytics. Sufra does not write to, modify or otherwise alter any data in your POS.

3.1.1 Payment write-back. Sufra may, where a Module and your POS provider support it and you have enabled it in the Merchant Dashboard, write a payment, settlement or refund record to your POS to reflect a payment taken through the Platform. Write-back is not enabled by default and Sufra will write nothing to your POS until you enable it. Where enabled, you remain responsible for reconciling your POS against your own records and against the statements Sufra provides, and Sufra is not responsible for any consequence of a POS system rejecting, duplicating or mis-recording a written record.

You will provide, and procure that your POS provider provides, all access, credentials, API permissions and technical cooperation reasonably required for Sufra to establish and maintain the connection, promptly and throughout the term.

Your POS is a third-party system Sufra does not control. Reporting reflects the data the POS supplies incomplete, misconfigured or manually mis-keyed records produce defective reporting. Analytics requires 30 days of operational data before meaningful insight is available; this is a function of data volume and is not a defect or a failure of the Services. Analytics is management information, not accounting, audit, tax or financial advice.

If the connection is unavailable, interrupted or withdrawn for any reason not attributable to Sufra including any act or omission of you or your POS provider Sufra is not in breach and analytics may be unavailable or incomplete for that period. If your POS vendor withdraws or materially changes its interface, Sufra may cease this Module for that Branch on 30 days’ notice and your sole remedy is a pro-rata refund of pre-paid Fees. If you change POS system, Sufra is under no obligation to integrate with the replacement, and any such integration is the subject of a separate written agreement.

3.2 Data isolation. Your transaction and POS data is held in isolation. Sufra will not disclose your raw transaction, sales or POS data to any other merchant, and will not publish, sell or license any benchmark, ranking, index or comparative output in which you or any Branch is identified, named, or reasonably capable of being identified whether directly, by pseudonym, or by inference from small sample size, cuisine, location or any other characteristic. Material term.

3.2.1 Permitted market aggregates. Clause 3.2 does not prevent Sufra from producing and publishing market-level reporting on the Qatari food and beverage sector (“Market Aggregates”), provided every Market Aggregate:

• is aggregated across no fewer than ten (10) distinct merchants in the relevant category, segment or geography;
• contains no merchant name, brand, Branch, logo or other identifier;
• presents no figure from which any single merchant’s revenue, covers, item mix or performance could reasonably be derived;
• is not produced or supplied at the request of, or tailored for, a specific competitor of yours.

Sufra may use, publish, license and charge for Market Aggregates, provided they do not identify the Merchant, a Branch or a Guest and do not permit their reasonable re-identification. Sufra owns the intellectual property in the methodology and resulting aggregated outputs. Nothing permits disclosure of raw Merchant Data or personal data.

3.3 Ordering two flows. The Ordering Module operates in either or both of the following ways at a Branch, as configured in the Merchant Dashboard.

3.3.1 Basket with waiter confirmation. The Guest scans a QR code at the table, opens the Digital Menu, selects items into a Basket and calls a waiter through the Platform. The waiter attends the table, reviews the Basket, confirms it with the Guest, and enters the confirmed order into your POS.

A Basket is an expression of Guest intent only. It is not an order and has no effect until a waiter confirms it. Sufra does not transmit, push or write any Basket to your POS. All POS entry in this flow is performed by your staff, and Sufra bears no responsibility for the accuracy, completeness or timeliness of any order your staff enter.

3.3.2 Guest-placed orders. Where enabled, a Guest may place an order directly through the Platform, which is delivered to your Merchant Dashboard for acceptance and fulfilment. The order takes effect between you and the Guest on your acceptance. You are responsible for monitoring the Dashboard, accepting or declining promptly, and keeping item availability current. Sufra transmits the order; it does not accept it on your behalf and gives no undertaking that you will see or act on it within any period.

3.3.3 Payments. Under either flow, every contract for the supply of food and beverage is concluded directly between you and the Guest. Sufra is not the seller and does not take title to any item. Guest payments made through the Platform are processed by Tap Payments. Sufra is the merchant of record to Tap and operates the marketplace account through which a Guest payment is recorded; you participate as Sufra's sub-merchant. A payment is allocated between you and Sufra in accordance with the rates in the Fee Schedule, and Tap settles your share to your nominated bank account and Sufra's Commission to Sufra. Sufra is not a bank, is not a payment service provider, does not provide escrow or custody, and does not hold Guest funds on deposit. Settlement timing is set by Tap and is currently two (2) Business Days after the transaction date, or five (5) Business Days for American Express. Sufra does not control settlement timing and gives no undertaking as to it. Your participation requires a Tap business account and Tap Destination, established through Sufra's onboarding and mapped to your Branches. You will provide all information, documentation and verification Tap requires, and Sufra may suspend the payments function for a Branch where that verification is incomplete, withdrawn or rejected. The payments function depends on Sufra's agreement with Tap. If that agreement ends or is suspended for any reason, Sufra may suspend or withdraw the payments function on notice, and no compensation, refund or damages arise.

3.3.4 QR codes. Where QR codes, redirect services, internet connectivity or related components are supplied or controlled by a third party, their operation depends on systems outside Sufra's control. A delay, failure or cessation not caused by Sufra does not constitute breach and is subject to Clause 11.7.

3.3.5 Consumer and electronic transaction information. The Merchant is the supplier of food, beverages and restaurant services and is responsible for providing all supplier, product, price, tax, delivery, cancellation, refund and other information required by Applicable Law, honouring confirmed orders and bookings, issuing any required receipt or confirmation, and handling Guest complaints. Sufra may technically display or transmit that information but does not become the seller or supplier. Nothing in the Agreement limits any mandatory statutory right of a Guest.

3.3.6 Refunds. You remain responsible for deciding whether a refund is due and for the underlying supply. Sufra provides the mechanism and may process a full or partial refund on your instruction given through the Merchant Dashboard. You will resolve a Guest complaint promptly and issue a refund where one is properly due, so that a dispute does not become a chargeback. Sufra may issue a refund without your instruction where required by Applicable Law, by Tap, by a card scheme or by a competent authority, and will notify you when it does. A refund issued as a customer-service measure is not an admission of liability by Sufra. A refunded amount is recovered from you under Clause 3.3.8, including any portion already settled to you. Sufra's Commission on a refunded transaction is returned to you in proportion to the amount refunded, unless the refund arises from your breach of the Agreement.

3.3.7 Chargebacks. A Guest may dispute a payment with their card issuer. Because Sufra is the merchant of record to Tap, Sufra is the party answerable to Tap in the first instance and the amount is recovered from Sufra by Tap. Sufra will notify you promptly and request the evidence needed to defend the dispute. You will supply it within three (3) Business Days, including order records, receipts, collection or delivery confirmation, correspondence and any till or CCTV record you hold. Sufra may represent the transaction using that evidence, and may decide not to defend a dispute it reasonably considers unlikely to succeed. The chargeback amount, and any scheme, Tap or administration fee associated with it, are your responsibility in every case and are recovered from you under Clause 3.3.8, including where you have complied with every other requirement of the Agreement. The sole exception is a chargeback resulting from Sufra's own proven failure to transmit or process the transaction correctly. The card issuer's decision, and Tap's decision to accept or reject a chargeback, are final. You have no right of recourse against Sufra in respect of either, and Sufra bears no liability for the outcome regardless of the circumstances. Chargeback ratio. You will keep your chargeback-to-sales ratio below 0.5% in any calendar month. Where that ratio is exceeded Sufra may suspend the payments function at the affected Branch immediately, require a reserve under Clause 3.3.8, or terminate under Clause 12.2. This limit is materially tighter than the threshold Sufra is subject to under its own agreement with Tap, and exists because a single Merchant's disputes can jeopardise the payments function for every Merchant on the Platform.

3.3.8 Recovery, set-off and negative balance. Where an amount becomes recoverable from you - a refund, a chargeback, a scheme, Tap or administration fee, an overpayment, a duplicate settlement, an amount paid on a transaction later found to be fraudulent, or any Fee due and unpaid - Sufra may recover it by any of the following, in any order: (a) deducting it from your next and subsequent settlements until recovered in full; (b) withholding settlement of an amount reasonably equal to the sum at risk where a dispute, investigation or suspected fraud is open, or where Tap has suspended or withheld the corresponding payout to Sufra; (c) requiring a reserve, being a stated amount or rolling percentage of settlements held back, where your chargeback ratio, dispute history or risk profile reasonably requires it, released when the risk has passed; (d) invoicing you directly for any amount not recovered within thirty (30) days, payable within fourteen (14) Business Days; or (e) setting it off against any amount Sufra owes you under the Agreement. Negative balance. Where recoverable amounts exceed settlements due to you, your account carries a negative balance. That balance is a debt due from you to Sufra, payable on demand, and is not extinguished by you ceasing to use the Platform. Sufra will give you a statement showing each deduction, withholding or reserve and what it relates to. You may dispute one within ten (10) Business Days of the statement, stating the amount and grounds, and the Parties will resolve it in good faith within fifteen (15) Business Days. Undisputed amounts remain recoverable meanwhile. Sufra may also suspend or delay settlement to you where Tap suspends or delays the corresponding payout to Sufra, for any reason permitted under Sufra's agreement with Tap. Sufra will notify you and release the amount when Tap does. Nothing in this Clause requires Sufra to fund a refund or chargeback on your behalf.

3.3.9 Fraud, testing and unlawful use. You will not, and will procure that your Personnel do not, process a payment that is not a genuine sale of food or beverage at a Covered Location. This includes a cash advance, a transaction on your own card or a Personnel card other than for a genuine purchase, splitting a single sale to avoid a limit, processing a transaction for another business, a fictitious or duplicate transaction, or any transaction prohibited by Applicable Law or by a card scheme. Breach of this Clause is a material breach. Sufra may suspend the payments function immediately and without notice, withhold settlement of the affected amounts pending investigation, and terminate under Clause 12.2.

3.4 Bookings no volume guarantee. Sufra transmits requests. Sufra does not guarantee attendance, cover count or revenue. Guest–Merchant booking disputes are between you and the Guest; Sufra may supply booking records but does not arbitrate.

3.5 Changes and new features. Sufra may improve or replace features within a Module. Material removal of a feature in active use will be notified at least 7 Business Days in advance, and Sufra will not materially reduce a Module’s core functionality without 30 days’ notice and, where the reduction is materially adverse, you may cancel that Module immediately with no notice month payable.

New features are included in your Subscription Fee by default. Sufra reserves the right, at its sole discretion and case by case, to designate any new major feature or Module as a separately priced add-on. Where it does, Sufra will notify you in writing before that feature is made available and you are under no obligation to purchase it. Declining a separately priced feature does not affect your access to the Modules you already hold. Beta features are features Sufra makes available before general release, identified as “beta”, “trial”, “preview” or “early access” in the Merchant Dashboard or in writing at the time access is given, and provided free of charge or at a stated discount. They are optional Sufra will not enable one at a Branch without your agreement. Beta features are supplied “as is”, carry no warranty, are excluded from the Clause 11.1 uptime target and the Clause 11.2 support response times, and may be changed or withdrawn at any time without notice. Sufra may not classify a feature as beta retrospectively, and a feature you pay a full Subscription Fee for is not a beta feature.

3.6 Menu information your data, your responsibility. All menu information published through the Platform is supplied by you. Sufra is a conduit for it and nothing more.

3.6.1 You supply, and are solely responsible for the accuracy, completeness, currency and lawfulness of, every element of it, including:

• item and dish names;
• prices, including any service charge, cover charge or tax component;
• descriptions, images, and portion or size information;
• ingredients and their composition;
• nutritional information, including calories and macronutrients where displayed;
• allergen declarations, including the presence of, and cross-contamination risk from, any allergen;
• dietary and religious classifications, including halal, vegetarian, vegan and gluten-free claims;
• availability, and any condition, exclusion or restriction on an item.

3.6.2 Sufra does not create, verify, audit, test, approve or endorse any menu information. Publication through the Platform is not a representation by Sufra that any of it is correct. Sufra gives no warranty of any kind, to you or to any Guest, as to menu information.

3.6.3 You will keep menu information current and correct it immediately on any change to a recipe, ingredient, supplier, preparation method, price or availability. You will not rely on a scheduled update cycle where the change affects an allergen, ingredient or nutritional declaration.

3.6.4 You will comply with Law No. 8 of 2008 on Consumer Protection, Law No. 8 of 1990 on the Regulation of Human Food Control, and all requirements of the Ministry of Public Health, the Ministry of Commerce and Industry and the relevant municipality on food description, labelling, allergen disclosure, nutritional declaration and price display including any requirement to display information in Arabic.

3.6.5 Guests may rely on allergen, ingredient and nutritional information for health reasons. Any claim, loss, injury, fine or penalty arising from menu information that is inaccurate, incomplete, out of date or misleading is yours alone, and your indemnity at Clause 11.8 applies to it.

3.7 Onboarding. Sufra will use commercially reasonable efforts to complete standard initial setup within five (5) Business Days after the Merchant has supplied complete and accurate menu content, POS access, credentials, technical cooperation, approvals and information. The period is a target, not a guaranteed completion date, and is extended for any Merchant or third-party delay, incompatibility, dependency or change request. Additional, bespoke or repeated training, integration or configuration is chargeable if stated in the Fee Schedule.

3.8 Hardware. Where Sufra supplies equipment QR stands, tablets, printers or otherwise it is listed in the Order Form and supplied on loan.

• Title remains with Sufra at all times. No title passes to you. You will not sell, pledge, charge, lend, sub-let, move to an unlisted Branch, modify or open any item, or permit any lien over it.
• Risk passes to you on delivery and remains with you until return or collection. Keep it in good condition, fair wear and tear excepted.
• Notify Sufra within 2 Business Days of any loss, theft or damage. You will pay the replacement value stated in the Order Form for any item lost, stolen, damaged beyond fair wear and tear, or not returned under (e).
• Sufra repairs or replaces items failing through manufacturing defect or fair wear and tear at no charge. Repair from misuse, neglect, liquid damage or unauthorised modification is chargeable.
• Return within 14 days of termination, or of cancellation of the Module the equipment supports, complete with accessories. Sufra may attend a Branch to collect on reasonable notice. Items not returned in that period are treated as lost under (c).

4. LICENCE AND RESTRICTIONS

4.1 Licence. Subject to timely payment and compliance with the Agreement, Sufra grants a limited, non-exclusive, non-transferable, non-sublicensable and revocable licence to use the selected Modules at the listed Branches for the Merchant's internal operations during the Term.

4.2 Restrictions. You will not:

• resell, sublicense, rent or run a service bureau for any other restaurant business;
• use the Platform for any location not listed in the Order Form including additional branches, ghost or dark kitchens, franchise locations, pop-ups, catering operations or affiliated brands at separate premises;
• copy, modify, decompile, reverse engineer or derive source code, structure or algorithms, except where mandatory law permits;
• circumvent security, authentication, rate limiting or access control;
• scrape, crawl, bulk-export or use unauthorised API calls;
• use the Platform to build, train, benchmark or improve a competing product, or help a third party do so;
• upload unlawful, defamatory, infringing or malicious content;
• breach the Data Protection Law or Law No. 14 of 2014 (Prevention of IT Crimes).

Verification. Where Sufra reasonably suspects unlicensed Branch use, you will supply usage records on request. Established unlicensed use means Fees backdated to first use, without prejudice to Sufra’s other remedies.

4.3 Optional exclusivity. Exclusivity applies only where the applicable Order Form expressly marks a particular Module at specified Branches as "Exclusive". Any exclusivity is limited to that Module, those Branches and the stated period and does not restrict systems expressly disclosed in the Order Form. No exclusivity applies to POS, accounting, inventory, payment, delivery marketplace, general marketing or other systems that do not perform the same selected Module.

Any exclusivity shall be interpreted narrowly and only to the maximum extent permitted by Law No. 19 of 2006 concerning Protection of Competition and Prevention of Monopolistic Practices. If a restriction would be prohibited or require approval, it shall be modified to the minimum lawful scope or shall not apply pending the required approval.

A system disclosed in the Order Form may continue at the disclosed Branches and for the disclosed function. A material breach of a valid and applicable exclusivity election is subject to Clause 12.2. No restriction continues after the relevant Module or Agreement ends.

5. TERM

5.1 No minimum term. There is no minimum commitment period and no early termination charge. On cancellation you pay the Subscription Fees for the one-month notice period and nothing further.

6. FEES AND PAYMENT

6.1 Fees are in QAR, charged monthly per Module per Branch per the Fee Schedule. Sufra invoices monthly in advance; the first invoice issues at the end of the Trial Month.

6.2 Payment. Invoices are due within fourteen (14) Business Days after the invoice date, without set-off, deduction or counterclaim except to the extent required by Applicable Law.

6.2.1 Late payment fee. No interest is charged. No interest of any kind accrues or is payable on any overdue amount under the Agreement.

Where an invoice remains unpaid for fourteen (14) Business Days after its due date, a fixed administrative charge of QAR 100 may be applied, plus QAR 100 for each later calendar month or part of a month it remains unpaid, capped at QAR 500 per invoice.

The charge is a fixed amount, is not a percentage, does not compound and represents agreed compensation for recurring collection administration. Sufra may also recover reasonable documented third-party collection and legal costs to the extent awarded or permitted by Applicable Law. Any agreed compensation remains subject to the powers of a competent court under the Civil Code.

6.3 Invoice disputes. Notify Sufra of a genuine invoice dispute within ten (10) Business Days after receipt, identifying the disputed line and supporting records. Pay all undisputed amounts on time. Failure to dispute within that period constitutes acceptance except for manifest calculation error or fraud.

6.4 Sufra may change Fees on 60 days’ notice. Reject a change by cancelling the affected Module before it takes effect no notice month payable in that case.

6.5 Taxes. Fees exclude VAT and any other applicable indirect tax. Qatar has not implemented VAT as at the Effective Date. If VAT or another tax becomes applicable, Sufra may add it from its legal effective date. Each Party remains responsible for taxes imposed on it by law. If the Merchant is legally required to withhold an amount, it shall provide the required certificate and, unless prohibited by law, gross up the payment so Sufra receives the invoiced Fee.

6.6 Fees are non-refundable except where the Agreement expressly provides otherwise. Annual or other advance payment does not by itself create a minimum term. On a permitted cancellation, any unused prepaid Subscription Fee after the applicable notice period shall be refunded or credited, except where termination results from the Merchant's breach.

7. YOUR OBLIGATIONS

You will:

• comply with Qatari law, including Law No. 13 of 2016 (Personal Data Privacy Protection), Law No. 8 of 2008 (Consumer Protection), Law No. 8 of 1990 (Regulation of Human Food Control), Law No. 14 of 2014 (Prevention of Information Technology Crimes), and all hygiene, labelling and public health requirements of the Ministry of Public Health and the relevant municipality;
• keep Merchant Data accurate, current, lawful and non-misleading, and hold all rights to upload it;
• supply and maintain all menu information, and bear sole responsibility for its accuracy, in accordance with Clause 3.6 including ingredients, nutritional information and allergen declarations, updated immediately on any recipe, supplier or preparation change;
• honour at the Branch the prices, offers, availability and booking terms you publish, and display prices in Arabic where required by MOCI;
• not give a Guest inferior service, pricing or seating because they came through Sufra;
• train Personnel on the Modules and specifically on the Clause 8 restrictions;
• name a primary operational and data protection contact and keep it current;
• supply timely access, credentials and vendor authorisations for integration Sufra is not responsible for delay you cause;
• maintain your own connectivity, hardware and devices at your cost;
• not state or imply that Sufra endorses, certifies, rates or guarantees you or your food.

8. GUEST DATA AND DATA PROTECTION

Material obligations. A serious, repeated or unremedied breach of this Clause may entitle Sufra to suspend or terminate the affected access under Clause 12.

8.1 Allocation of roles. Sufra acts as controller for Guest registration, Sufra-wide profile management, consent records, Platform security, service analytics and other purposes Sufra determines and discloses in its privacy notice. When Guest Data is disclosed to the Merchant for a booking, order, visit, service request or permitted marketing, the Merchant acts as an independent controller for its own processing and is responsible for its legal basis, notices, security, retention and response to Guest rights. Where Sufra processes Merchant-controlled personal data solely on documented Merchant instructions to provide a configured Module, Sufra acts as processor under the Data Protection Annex. The factual allocation prevails over any label.

8.2 Disclosure trigger. Nothing is disclosed to a Branch until the Guest has an Interaction with that Branch. An Interaction is: (a) making, confirming or modifying a booking; (b) placing an order; (c) scanning that Branch’s QR code or opening its Digital Menu; (d) checking in at that Branch; or (e) a POS transaction matched to their Sufra account.

8.3 What is disclosed two tiers. From the moment of Interaction, and only then:

The History tier reflects the data isolation guaranteed at Clause 3.2. Sufra will not disclose to you, in any form, a Guest’s transaction or spend history at another merchant.

8.3.1 Guests who withhold identity. Each Guest controls disclosure through two independent switches in their Sufra profile. Identity name and date of birth is enabled on registration and may be switched off at any time, before or after a visit. Marketing is disabled on registration and governs the mobile number under Clause 8.3.2. Where a Guest has switched Identity off:

• you receive no name and no date of birth;
• you continue to receive their taste profile, allergens, preference notes, orders, item modifications, special requests, spend, visits and frequency at your own Branches, so you can serve them properly;
• you have no means of contacting that Guest and no marketing right in respect of them, and you will not attempt to identify them, match them to any record you hold, or ask them for contact details for the purpose of circumventing their choice;
• the data you receive remains personal data under the Data Protection Law notwithstanding the absence of a name. It is pseudonymous, not anonymous. Clause 8 applies to it in full, including the prohibitions at Clause 8.7 and the deletion duty at Clause 8.9;
• a Guest may switch identity sharing on or off at any time, including after a visit. You will not treat a Guest less favourably, refuse service, apply different pricing, or degrade their experience because they have withheld their identity.

Breach of paragraph (c) or (e) is a material breach for the purposes of Clause 12.2.

8.3.2 Mobile numbers you do not receive one by default. A Guest’s mobile number is disclosed to you only where that Guest has switched Marketing on in their Sufra profile. It is not disclosed on booking, on ordering, on payment, or on request.

• Until a Guest switches Marketing on, you hold no means of contacting that Guest, and service communications reach the Guest from Sufra through the Platform.
• Where a Guest switches Marketing on, you may use the number to contact that Guest and to send marketing in accordance with Clauses 8.5 and 8.6.
• Where a Guest switches Marketing off, or deletes their account, you will cease all use of that number immediately and delete every copy of it in the Platform, in any export, and in any system of yours within seven (7) days of notification by Sufra. This obligation applies whether notification is given through the Merchant Dashboard, by email, or by API.
• You will not ask a Guest for their mobile number, or accept one offered, for the purpose of circumventing a Marketing switch that is off. A Guest who gives you their number directly and independently of the Platform is governed by Clause 8.6.
• You will not condition service, a booking, a table, an offer or any benefit on a Guest switching Marketing on.

Breach of paragraph (c), (d) or (e) is a material breach for the purposes of Clause 12.2 and is outside the liability cap under Clause 11.6.

8.3.3 Special Nature Personal Data. Allergy, dietary, health, religious, children's or similar information may constitute Special Nature Personal Data. Each Party acting as controller shall identify a lawful and permitted basis, obtain explicit consent where required, complete any required assessment and obtain any permission or approval required by the competent authority before processing it. The Merchant shall use only designated Platform fields, shall not place such data in free-text notes or unsupported systems, and remains responsible for Special Nature Personal Data it independently collects or exports.

8.4 No general access. You have no right of access to the Sufra Guest database. You may not view, search, browse, query or receive the profile of any Guest who has not had an Interaction with your Branches. Sufra does not provide, and you will not request, bulk Guest Data.

8.5 Permitted use only these four:

• fulfilling and servicing the booking, order or visit the Interaction relates to;
• personalising that Guest’s experience at the Branch (seating, dietary accommodation, recommendation);
• contacting that Guest about that specific booking, order or visit, only where you hold their mobile number under Clause 8.3.2, using only the channel Sufra records, and not after that booking, order or visit is closed. Where you do not hold a number, service communications confirmations, delays, item unavailability are delivered to the Guest by Sufra through the Platform, and you will raise them there rather than seeking contact details;
• complying with a legal obligation or a lawful request from a Qatari competent authority.

8.6 Marketing - current consent required. The Merchant may market to a Guest only where the Platform records a current, valid consent covering the relevant Merchant, channel and purpose, or where the Merchant independently holds another lawful basis permitted by Applicable Law. A disclosed mobile number is evidence only of the consent status recorded at the time of disclosure and does not relieve the Merchant of its obligations as controller. Every communication must identify the sender, state its marketing nature, provide a valid contact address and effective opt-out, and cease promptly following withdrawal, objection or a suppression notice from Sufra. The Merchant shall maintain appropriate consent and suppression records and shall not combine Platform data with independently obtained data to circumvent a Guest's choice.

8.7 Export permitted, onward sharing prohibited. You may export, download and retain Guest Data relating to Guests who have had an Interaction with your own Branches, for your own internal use at those Branches. Exported data remains subject to this Clause 8 in your hands, including the marketing consent requirement at Clause 8.6 and the deletion duty at Clause 8.9. You will not:

• export, download, copy, photograph or transcribe the Guest Data of any Guest who has not had an Interaction with one of your Branches;
• place Guest Data in a system, file or account accessible to a third party unless the third party is an authorised processor bound by a written data-processing agreement, confidentiality, security and deletion obligations compliant with Applicable Law;
• sell, rent, publish or disclose Guest Data to another restaurant, data broker, marketing platform or other third party for its own purposes, or share it with an affiliate, franchisor, franchisee or agency unless Sufra has approved the disclosure in writing and the Merchant has a lawful basis and has provided every required notice;
• use Guest Data to build, enrich or train any profile, model or dataset outside the Platform;
• use Guest Data for any location that is not a licensed Branch;
• retain Guest Data after your right to process ends;
• attempt to re-identify de-identified or aggregated data.

8.7.1 Staff notes. Where your Personnel record notes on a Guest profile, notes may record preferences and service requirements only. Notes must not record opinions or judgements about the Guest as a person, their appearance, conduct, nationality, religion, politics or finances, and must not record health information allergens have their own field, which the Guest controls. Guests may view, correct and request deletion of every note held about them. Sufra may delete any note breaching this clause and act against you for a persistent breach.

8.8 Personal data incidents. Notify Sufra without undue delay and, where practicable, within twenty-four (24) hours after becoming aware of any actual or suspected unauthorised access to, disclosure, loss, alteration or unavailability of Guest Data. Preserve evidence, mitigate harm and provide the information reasonably required for assessment and notification. The relevant controller is responsible for notifications to the competent authority and affected individuals within the period required by Applicable Law and binding regulatory guidance, including the applicable seventy-two (72) hour period where required. The Parties shall coordinate communications where legally permitted, but neither Party may prevent the other from making a disclosure required by law.

8.9 Deletion on exit. On termination of the Agreement, or of the Guest Profiles Module at a Branch, or on Sufra’s written request where you are in breach of this Clause:

• Inside the Platform automatic. Your access to Guest Data ends on the effective date and Sufra deletes or blocks it from your Dashboard automatically. No action is required from you and nothing is left for you to remove;
• Outside the Platform your duty. Sufra cannot reach copies you exported. You will cease all processing of them immediately and, within 30 days, securely delete every copy you hold in any location or format exported files, spreadsheets, your own systems, backups, printed lists, messaging apps, and Personnel’s personal devices;
• procure that Personnel and any person you gave access to do the same;
• within the same 30 days, deliver Sufra written certification of deletion signed by an authorised signatory, covering the copies in paragraph 2;
• where a mandatory Qatari legal obligation requires you to keep a specific record, tell Sufra the record and the basis, keep it only as long as required, apply this Clause 8 to it throughout, then delete it.

8.10 Guest rights requests. If a request concerns Sufra's controller processing, forward it to privacy@sufra.tech within two (2) Business Days and assist Sufra. If it concerns processing for which the Merchant is controller, the Merchant shall respond within the period required by Applicable Law and shall inform Sufra where Platform assistance is reasonably required. Neither Party may answer on behalf of the other without authority.

8.11 Audit. Once per 12 months or at any time where Sufra reasonably suspects breach Sufra may request written evidence of your compliance, including where Guest Data sits and who can access it. Respond within 15 days.

8.12 Clauses 8.7 to 8.10 survive termination.

9. HOSTING, SECURITY AND IP

9.1 Hosting and cross-border processing. The current hosting regions and material sub-processors are identified in Sufra's then-current privacy notice, Data Protection Annex or sub-processor list. Personal data may be processed outside Qatar only where the transferring Party has assessed the transfer, provided required notices, implemented contractual and technical safeguards, and ensured a level of protection consistent with the Data Protection Law and binding regulatory guidance. Sufra shall notify the Merchant before a material change to a notified primary hosting region where reasonably practicable.

9.2 Sub-processors. Sufra may appoint affiliates and third-party sub-processors necessary for hosting, support, communications, security, analytics and service delivery. Sufra shall contractually require appropriate confidentiality, security and data-protection obligations and remains responsible for processor obligations that Applicable Law places on Sufra. Sufra will provide a current list on request and give at least thirty (30) days' notice before a material new sub-processor handles personal data, except where urgent replacement is required for security, continuity or legal compliance.

9.3 Security. Sufra maintains encryption in transit and at rest, role-based access control, logical separation of merchant environments, access logging and periodic review. You secure your own systems, devices and networks and will not introduce malicious code. Each party notifies the other without undue delay of any security incident.

9.4 IP ownership. Sufra owns the Platform, its software, interfaces, data models, algorithms, reporting methodologies and brand. You own Merchant Data and your own brand assets, and grant Sufra a non-exclusive royalty-free licence during the term to host, store, reproduce, transmit, display and format them solely to deliver the Modules and operate, secure and support the Platform.

9.5 Aggregated data. Sufra may create and use statistics, insights and datasets derived from Merchant Data and Guest Data only where they are aggregated or de-identified so that the Merchant, a Branch, Personnel and Guests are not reasonably identifiable. Sufra may use them for analytics, benchmarking, security, product development and commercial reporting and owns the intellectual property in the resulting methodology and outputs. This Clause does not permit disclosure of raw data or re-identification.

9.6 Marketing use of your name. Sufra may name you as a customer and use your logo in its website, sales and investor materials. Withdraw that permission in writing at any time and Sufra will stop within 30 days.

9.7 Feedback. Sufra may use your suggestions and feature requests freely, without attribution or payment. This grants no rights over Merchant Data or Confidential Information.

10. CONFIDENTIALITY

Each party will keep the other’s non-public information confidential, use it only for the Agreement, and share it only with personnel and advisers who need it under equivalent obligations. Covers the Fee Schedule, non-public Platform functionality, security arrangements, roadmap, and your sales and transaction data.

Excluded: information that is public other than by breach, was lawfully known before disclosure, was independently developed, or must be disclosed by law or a competent authority with prior notice where lawfully permitted.

Survives five (5) years after termination. Personal Data obligations survive without limit.

Commercial terms are confidential. You will not disclose your Subscription Fees, any discount, or any commercial term of the Agreement to any third party including other restaurants, media, social media, or any public or semi-public forum. Disclosure is permitted only to your professional advisers and auditors under equivalent obligations, where required by Qatari law or a competent authority (giving Sufra maximum practicable advance written notice), or with Sufra’s prior written consent. Breach of this paragraph is a material breach.

11. AVAILABILITY, WARRANTIES AND LIABILITY

11.1 Availability. Sufra will use commercially reasonable efforts to provide the paid Modules. No minimum uptime, service credit or guaranteed restoration time applies unless a separate written service level agreement signed by Sufra expressly states it. Availability excludes scheduled or emergency maintenance, permitted suspension, Merchant acts or systems, and external failures described in Clause 11.7.

11.2 Support. Support requests may be sent to info@sufra.tech. Sufra will use commercially reasonable efforts to acknowledge a valid support request within one (1) Business Day, but acknowledgement is not a guaranteed resolution time.

11.3 No commercial guarantee. Sufra provides software. Sufra does not warrant or guarantee any increase in covers, orders, revenue, retention, satisfaction or profitability. Any figure discussed in a sales conversation is illustrative and is not a term of the Agreement.

11.4 Warranties. Each party warrants authority to contract. Sufra warrants it will provide the Modules with reasonable skill and care. You warrant you hold all required licences, that Merchant Data infringes no third-party right, that you will comply with the Data Protection Law, and that you and your owners and managers are not subject to any sanction making this Agreement unlawful.

11.5 Disclaimer. Except for the express warranties in the Agreement and to the maximum extent permitted by Applicable Law, the Modules are provided "as available". Sufra does not warrant uninterrupted or error-free operation, compatibility with every third-party system, correction of every defect, fitness for a particular business objective or any commercial outcome. Nothing excludes liability for fraud, wilful misconduct, gross negligence or any liability that cannot lawfully be excluded.

11.6 Liability.

11.7 External and third-party failures; no compensation. To the maximum extent permitted by Applicable Law, Sufra is not liable for, and the Merchant is not entitled to compensation, damages, a refund, credit, Fee reduction, lost profit, lost revenue or another remedy arising from an interruption, delay, degradation, error, data-transmission failure or unavailability that is not caused by Sufra's breach of the Agreement and is beyond Sufra's reasonable control. This includes failures of electricity, internet or telecommunications networks, POS systems, payment processors, banks, cloud or hosting providers, third-party software or APIs, QR redirect providers, delivery platforms, hardware, the Merchant's systems or Personnel, cyberattacks or malicious third-party acts, and governmental or regulatory action. Sufra will use commercially reasonable efforts to restore an affected Module where reasonably practicable; those efforts are not an admission of liability or an obligation to compensate the Merchant. Nothing in this Clause excludes liability that Applicable Law does not permit to be excluded.

Sufra is not liable for claims arising from the Merchant's food, beverages, premises, service, Personnel, hygiene, pricing, fulfilment, refunds, allergens, licences, menu information or Guest disputes. The Merchant shall maintain independent records of bookings, orders and sales. Subject to Clause 11.6, any liability for recoverable data loss is limited to the reasonable cost of restoration from the most recent available backup.

11.8 Your indemnity. You will indemnify Sufra against all claims, losses, fines, penalties and reasonable legal costs arising from: (a) your breach of Clause 8, including any regulatory fine imposed on Sufra by the NCSA attributable to it; (b) any Guest or third-party claim about your food, service, premises, hygiene, pricing, or any menu information supplied by you under Clause 3.6 including ingredient, nutritional and allergen declarations; (c) any claim that Merchant Data infringes third-party rights; (d) your breach of Clause 4 or unlicensed-location use; (e) your breach of applicable law.

11.9 Sufra’s indemnity. Sufra will indemnify you against any claim that your authorised use of the Platform infringes third-party IP rights in Qatar, provided you notify promptly, give Sufra sole control of defence and settlement, and assist. Excludes claims arising from Merchant Data, from modification by anyone other than Sufra, or from combination with anything Sufra did not supply.

12. SUSPENSION AND TERMINATION

12.1 Suspension. Sufra may suspend any Module or account immediately where reasonably necessary to protect security or personal data, prevent unlawful use, comply with law or a binding regulatory direction, address an actual or suspected material breach, prevent harm to Sufra, Guests or third parties, or where an invoice remains unpaid for fourteen (14) Business Days after its due date. Sufra will give notice where reasonably practicable and restore service after the cause is remedied. Fees remain payable during suspension caused by the Merchant.

12.2 Termination for cause. Either Party may terminate the affected Module or the Agreement by written notice if the other commits an irremediable material breach, fails to remedy a remediable material breach within fifteen (15) Business Days after written notice, becomes insolvent or ceases business, or loses a licence or commercial registration required for performance. Sufra may terminate immediately for unlawful use, a serious or repeated data-protection or security breach, unlicensed Branch use, infringement of Sufra IP, or a food, licensing or regulatory event reasonably exposing Sufra or Guests to material risk.

12.3 Cancellation for convenience. After any Trial Month, either Party may cancel a Module at a Branch, or terminate all Modules, on one (1) calendar month's written notice. The Merchant may give notice during a Trial Month so cancellation takes effect at its end without Subscription Fees. This Clause does not create a minimum term.

12.4 On termination: all licences end and the Merchant shall stop using the Platform; all accrued and undisputed amounts become due; Clause 8.9 applies to Guest Data; the Merchant may request an export of its own Merchant Data within thirty (30) days in a commonly used format, after which Sufra may delete it subject to documented retention and backup procedures; hardware shall be returned under Clause 3.8; and each Party shall return or securely destroy the other's Confidential Information on request, subject to legal retention.

12.4.1 Payments on termination. In addition to Clause 12.4: (a) Sufra will cease processing new Guest payments for you immediately; (b) a refund or chargeback may still arise on a transaction processed before termination, Clauses 3.3.6 to 3.3.8 continue to apply to it, and you remain liable for any amount recoverable for 180 days after the last transaction processed for you or such longer period as a card scheme permits a Guest to raise a dispute; (c) Sufra may withhold final settlement, in whole or in part, for that period, in an amount reasonably proportionate to your transaction volume and dispute history, and will release the balance at the end of it less any amount recovered; (d) any negative balance is immediately due and payable and Sufra may recover it as a debt; and (e) Clauses 3.3.3 and 3.3.6 to 3.3.9 survive termination.

12.5 Surviving clauses: provisions intended by their nature to survive include accrued payment obligations, licence restrictions, intellectual property, Guest Data and data-protection obligations, confidentiality, liability, indemnities, termination consequences, dispute resolution and Annex A.

13. CHANGES TO THESE TERMS

Sufra may amend these Terms by publishing the new version at sufra.tech/terms and notifying the Merchant’s registered contact. A change required for security, technical integrity, legal compliance or prevention of misuse may take effect immediately or when the applicable requirement demands. Other material changes will be notified at least thirty (30) days in advance. If such a change materially and adversely reduces a paid Module, the Merchant may cancel that affected Module by notice before the change takes effect. Continued use after the effective date constitutes acceptance only where the Merchant received the required notice and had a reasonable opportunity to retain the applicable version.

14. GENERAL

Force Majeure. Neither party is liable for delay or failure caused by events beyond reasonable control act of God, fire, flood, extreme weather, epidemic, war, civil unrest, terrorism, government action, embargo, failure of public telecoms or power, or cloud infrastructure failure. Notify promptly. If it continues 60 consecutive days, either party may terminate the affected Modules without liability.

Assignment. You may not assign or transfer without Sufra’s written consent. Sufra may assign to an affiliate or to a successor on merger, reorganisation or sale of its business or assets. Sufra may subcontract and remains responsible for its subcontractors.

Change of control. Notify Sufra within 15 days of any change in your control. If control passes to a person operating a business competing with Sufra, Sufra may terminate on 30 days’ notice.

Relationship. No partnership, joint venture, employment, franchise or agency is created. Sufra is not your commercial agent, distributor or payment agent, and this is not a commercial agency arrangement.

Notices. In writing to the Order Form addresses by hand, registered post, or email to the registered contact. Email is deemed received the next business day absent a delivery failure. Copy Sufra notices to main@sufra.tech.

Entire agreement. This Agreement supersedes all prior proposals, quotations, presentations and discussions. Neither party has relied on any statement not set out in it. Nothing here limits liability for fraud.

Severability, waiver, third parties. An invalid provision is severed to the minimum extent and the rest continues. Delay in exercising a right is not a waiver; waivers must be written. No non-party may enforce this Agreement.

Counterparts and electronic execution. An Order Form or Service Agreement may be executed in counterparts and by an electronic signature process. An electronic signature shall be attributable to the signatory, under the signatory's control and linked to the electronic record so that alteration is detectable, to the extent required by Decree-Law No. 16 of 2010. Sufra may retain electronic acceptance records as evidence.

15. LANGUAGE, GOVERNING LAW AND JURISDICTION

15.1 Language. These Terms are issued in English. As between the Parties, the English version prevails to the maximum extent permitted by Applicable Law. An Arabic translation may be prepared for convenience or official use; a certified Arabic translation required by a Qatari authority does not otherwise amend the Parties' commercial agreement.

15.2 Governing law. The laws of the State of Qatar, including in respect of non-contractual disputes.

15.3 Dispute resolution. The Parties shall first attempt in good faith to resolve a dispute through authorised representatives within fifteen (15) Business Days after written notice. Any dispute or controversy arising out of or in connection with the Agreement, including its existence, validity, interpretation, performance, breach or termination, shall then be referred to and finally resolved by arbitration under the Rules of Arbitration of the Qatar International Center for Conciliation and Arbitration (QICCA) in force when the notice of arbitration is submitted. The seat and legal place of arbitration is Doha, Qatar. The tribunal shall consist of one (1) arbitrator. The language is English. The award is final and binding. Nothing prevents a Party from seeking urgent interim or conservatory relief from a competent court, and Sufra may pursue an undisputed debt before the competent courts of Qatar.

16. CONTACT

Sufra Technology W.L.L. - CR No. 233626 - Building 15, Street 2322, Zone 51, Floor 2, Qatar Science & Technology Park, Doha, State of Qatar

General info@sufra.tech · Support info@sufra.tech · Privacy privacy@sufra.tech · Legal main@sufra.tech

References to a law include its amendments, implementing decisions and binding directions issued by the competent authority. Regulatory responsibilities and authority names shall be read as transferred to any lawful successor authority.

Version control. Sufra will retain an archived copy of each published version of these Terms and the electronic or signed record identifying the version accepted by each Merchant.

ANNEX A - DATA PROTECTION ANNEX

A1. Scope and precedence. This Annex governs personal data processed under the Agreement and prevails over inconsistent terms only on personal data matters. Each Party shall comply with the Data Protection Law and document the factual role it performs.

A2. Allocation of roles. The following allocation applies unless the factual processing requires a different legal classification:

A3. Processing by Sufra as processor. Sufra shall process Merchant-controlled personal data only on documented instructions in the Agreement, Order Form, configured Modules and lawful support requests, unless Applicable Law requires otherwise. Processing may include hosting, configuration, retrieval, transmission, analysis, support, security, export and deletion for the Term and documented backup, dispute and legal-retention periods. Data subjects may include Merchant Personnel, suppliers and Guests. Data may include account, contact, role, menu, configuration, POS reference, booking, order, operational and support records.

A4. Processor obligations. Sufra shall ensure authorised personnel are bound by confidentiality, implement proportionate technical and organisational measures, assist the Merchant with data-subject requests, assessments and incidents where reasonably required, and on termination return or delete Merchant-controlled personal data in accordance with documented retention and backup procedures. Assistance beyond standard product functionality may be charged at agreed professional-service rates.

A5. Independent-controller obligations. Each Party acting as controller shall identify and document its lawful basis, provide required privacy information, honour withdrawals and objections, maintain accurate and proportionate records, restrict access, apply an appropriate retention period, respond to rights requests, and not combine, sell, disclose or use personal data for an incompatible purpose.

A6. Special Nature Personal Data. Before processing Special Nature Personal Data, the relevant controller shall identify a permitted basis, obtain explicit consent where required, conduct any required assessment and obtain any permission or approval required by the competent authority. The Merchant shall use only designated Platform fields and shall not include health, allergy, religious, children's or similar information in unsupported free-text fields.

A7. Sub-processors and cross-border transfers. The Merchant authorises Sufra to appoint sub-processors necessary for the Services subject to Clause 9.2. Each transferring controller shall document cross-border transfers, assess risk, provide required notices and ensure contractual and technical safeguards that provide protection consistent with the Data Protection Law and binding regulatory guidance.

A8. Security and incidents. Each Party shall maintain proportionate access control, authentication, encryption where appropriate, logging, backup, vulnerability management and incident-response measures for systems under its control. A Party becoming aware of a personal data incident affecting shared data shall notify the other without undue delay, preserve evidence, mitigate harm and cooperate under Clause 8.8.

A9. Audit and cooperation. On reasonable written request not more than once in any twelve (12) months, Sufra shall provide available compliance information relevant to its processor obligations. Additional audits require reasonable notice, confidentiality, no unreasonable disruption and payment of the requesting Party's costs unless a material breach is established. Each Party remains responsible for its own acts, omissions, notices, lawful basis, permissions and regulatory dealings.

ANNEX B - PRIVACY NOTICE FOR DASHBOARD USERS

Who this is for. Anyone who signs into the Sufra Merchant Dashboard - the Merchant's owner, managers, waiters and contractors. It explains what Sufra holds about that person individually. It is not about Guests: Guest Data is covered by Clause 8, Annex A and the Sufra Privacy Policy at sufra.tech/privacy. The Merchant shall make this Annex available to every person to whom it gives Dashboard access, before that access is granted.

B1. Roles. Sufra is controller of your Dashboard account and security records - we decide what is needed to run and protect the Platform. Your employer is controller as your employer; your employment, pay, performance and conduct records are theirs and are not held by Sufra. Your employer sets up your account, decides what you can access, and can change or remove it.

B2. What Sufra holds about you. Your name, work email, mobile number, role and permission level, and which Branches you can access. Sign-in and sign-out times, one-time codes, failed attempts and password resets. IP address, device type, browser, operating system and app version. Messages you send to Sufra support and our replies. Sufra does not hold your salary, contract, performance reviews, disciplinary records or any other employment file.

B3. Why. To create your account and let you sign in; to control what you can see and do so Guest Data stays secure; to detect and prevent fraud, abuse and unauthorised access; to answer your support requests; to fix faults and improve the Platform using the minimum data needed; and to respond to a lawful request from a Qatari competent authority.

B4. No activity monitoring. Sufra does not monitor or record your individual activity in the Dashboard, and does not report what you do to your employer.

B5. Guest Data is not yours to take. You will see Guests' personal information in the course of your work. Open a Guest's profile only when you are serving that Guest. Do not photograph, copy, screenshot or write down Guest details for any other purpose. Do not save Guest contact details to your own phone, messaging apps or personal accounts. Do not share Guest details with anyone outside the Merchant's business. Notes added to a Guest profile must record preferences and service needs only - never opinions about the person, their appearance, conduct, nationality, religion, politics or finances. Guests can read every note written about them. Misuse of Guest Data may lead to suspension of your account and may expose you and your employer to penalties under Law No. 13 of 2016.

B6. Who else sees your data. Your employer, as described above. Sufra personnel who need it for support, security or administration. Sufra's service providers for cloud hosting, messaging and support, acting on Sufra's instructions under confidentiality and security obligations. A Qatari court, the police or a competent authority where lawfully required. Sufra does not sell your data and does not use it for marketing.

B7. Where it is stored. Your data is stored and processed on Amazon Web Services infrastructure in the Asia Pacific (Mumbai) region, India, outside the State of Qatar, with the safeguards described in Clause 9.

B8. How long. Account details while your account is active, then deleted within ninety (90) days of deactivation. Login and security records for twelve (12) months. Support correspondence for twenty-four (24) months. When you leave your job, your employer is responsible for deactivating your account promptly.

B9. Your rights. You may ask Sufra to tell you what it holds about you and provide a copy, correct anything inaccurate, delete data no longer needed, stop a particular use, or pause processing while a dispute is resolved. Email privacy@sufra.tech from your registered work address; Sufra responds within thirty (30) days and may ask you to confirm your identity. Requests about your employment - your contract, pay or performance - go to your employer, not to Sufra. If you are not satisfied with Sufra's response you may complain to the National Cyber Security Agency.

B10. Security. Sufra encrypts data in transit and at rest, separates each Merchant's environment from every other, and restricts internal access to Sufra personnel who need it. Use your own login and never share it or a one-time code, and tell your manager and privacy@sufra.tech immediately if you believe someone else has used your account. Where a breach puts your rights at serious risk, Sufra will notify the National Cyber Security Agency and you within seventy-two (72) hours of becoming aware of it.

B11. Changes. The current version of this Annex is always available in the Dashboard under Settings, Legal, with its effective date. Where a change materially affects you, Sufra will tell you in the Dashboard before it takes effect.