# Data Protection Addendum Source: https://legal.subtotal.com/legal/customers/data-protection-addendum This Data Protection Addendum (“**DPA**”) is part of and incorporated into the Subtotal [Services Agreement](https://www.subtotal.com/legal/customers/services-agreement) (the “**Agreement**”) between Subtotal, Inc. and Customer, each a “**Party**” and collectively the “**Parties.**” In the event of any conflict, this DPA shall prevail over that Agreement and any related contractual documents between the Parties, including any Order Form, statement of work, or other data protection or data processing agreement. Subtotal and Customer agree as follows: ## 1. Definitions For purposes of this DPA: 1.1. “**Data Privacy Laws**” means all applicable laws relating to privacy, data protection, data security, breach notification, or the Processing of Personal Data, including without limitation, to the extent applicable, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 *et seq.* (“**CCPA**”) and other applicable U.S. state and federal laws (collectively, “**U.S. Privacy Laws**”), the General Data Protection Regulation, Regulation (EU) 2016/679 (“**GDPR**”), the United Kingdom Data Protection Act of 2018 (“**UK GDPR**”), and the Swiss Federal Data Protection Act (“**FADP**”). 1.2. “**Personal Data**” includes “personal data,” “personal information,” “personally identifiable information,” and similar terms, and such terms shall have the same meaning as defined by applicable Data Privacy Laws, that Subtotal Processes to provide the Services. 1.3. The terms “**Business**,” “**Consumer**,” “**Controller**,” “**Data Subject**,” “**Process,**” “**Processor**,” and “**Service Provider**” have the meanings ascribed to them under Data Privacy Laws. Controller is deemed to include Business, Data Subject is deemed to include Consumer, and Processor is deemed to include Service Provider. 1.4. “**EU SCCs**” means the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 *on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council*, completed as set forth in Section 9 below. 1.5. “**Security Breach**” means a breach of security leading to the accidental or unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data. 1.6. “**Services**” means the services Subtotal provides to Customer, as set forth in the Agreement. 1.7. “**UK SCCs**” means the International Data Transfer Addendum to the EU SCCs (available at [https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf](https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf)). ## 2. Applicability This Addendum applies to Subtotal's provision of any Personal Data to Customer in connection with the Agreement. In the event of a conflict between this Addendum and the Agreement, this Addendum governs. ## 3. Relationship of the Parties With respect to Personal Data Processed by the Parties in connection with the Agreement and the Services, the Parties acknowledge and intend that each acts as an independent Controller or Business and not as joint controllers or joint businesses. ## 4. Obligations of Subtotal as Data Controller Subtotal alone shall determine, in accordance with applicable Data Privacy Laws, how Personal Data is Processed in connection with its provision of the Services to Customer. This includes, without limitation, deciding which data to collect from Data Subjects, how to collect it, how long to store it, which security measures to apply to it, which data to disclose to Customer (or Customer’s Service Providers, agents, and partners to which Customer has directed Subtotal to disclose such data, including through integrations in the Services to which Customer chooses to connect), and the legal basis for such Processing. Subtotal will provide Data Subjects with appropriate information and disclosures in accordance with applicable Data Privacy Laws and, where required, obtain their consent for the disclosure and use of their Personal Data by Customer as contemplated herein. Subtotal is solely responsible for providing any applicable opt out rights to Data Subjects with respect to such disclosures, and for passing those opt out requests to Customer where required by applicable Data Privacy Laws. ## 5. Right to Use; Obligations of Customer as Data Controller Customer may use and Process the Personal Data received from Subtotal for its legitimate business purposes as described in the Agreement. Customer shall comply with all requirements applicable to Controllers or Businesses under applicable Data Privacy Laws when processing such Personal Data. Customer will not “sell” or “share” (as those terms are defined in applicable Data Privacy Laws) the Personal Data provided by Subtotal unless otherwise permitted under applicable Data Privacy Laws, and where permitted, Customer shall ensure that such activities are disclosed in its privacy notices and that any legally-required consents are obtained or opt outs are provided. Customer shall not use Personal Data obtained from Subtotal to infer Sensitive Personal Information or Sensitive Data, or to make Sensitive Data Inferences (as defined in applicable Data Privacy Laws). ## 6. Cooperation by the Parties Each Party shall, upon request, provide the other with all documents and information necessary to enable compliance with Data Privacy Laws in connection with the Services, including information required to complete any data processing assessments. In case of inquiry or investigation by a data protection authority related to Processing of Personal Data in connection with the Services, the Parties agree to reasonably cooperate and to provide one another with all documents and information necessary to facilitate such cooperation. Each Party shall immediately inform the other in case of potential non-compliance with its Processing of Personal Data under applicable Data Privacy Laws. ## 7. Personal Data Request Each Party is responsible for intaking and responding to Data Subject requests (e.g., access, deletion, and correction) in accordance with applicable Data Privacy Laws. ## 8. Security Obligations Each Party agrees to maintain security controls and safeguards that are no less robust than those described in Attachment A-2. In the event of a Security Breach involving Personal Data subject to the Agreement, the Party who experienced the breach agrees to notify the other Party without undue delay and to reasonably coordinate with the other Party on the investigation and remediation of such Security Breach. ## 9. Data Transfers Each Party agrees to comply with applicable Data Privacy Laws when engaging in cross-border Processing of Personal Data, and authorizes the other Party to make cross-border transfers of Personal Data, provided that such laws are respected. To the extent legally required, by signing this DPA, Customer and Subtotal are deemed to have signed the EU SCCs, which form part of this DPA and are deemed completed as follows: (i) Module 1 of the EU SCCs applies to transfers of Personal Data from Subtotal (as a controller) to Customer (as a controller); (ii) Clause 7 (the optional docking clause) is not included; (iii) the optional language in Clause 11 (Redress) is not included; (iv) under Clauses 17 and 18, the Parties choose the laws of Ireland and the courts of Ireland to govern the DPA for transfers subject to the GDPR; (vi) Annex I(A) and I(B) are completed as set forth in Attachment A-1 of this DPA; (vii) Annex II is completed as set forth in Attachment A-2 of this DPA; and (viii) Annex III is inapplicable. To the extent legally required, by signing this DPA, the Parties are deemed to have signed the UK SCCs, which form part of this DPA and take precedence over the rest of this DPA as set forth in the UK SCCs. The Tables of the UK SCCs shall be deemed completed as follows: (i) Table 1: The Parties’ details shall be the Parties and their Affiliates, and the Key Contacts shall be the contacts set forth in the Agreement; (ii) Table 2: the Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties and completed in Section 9(b) of this DPA; (iii) Table 3: Annexes I and II shall be completed as set forth in Attachments A-1 and A-2 below, respectively, and Annex III is inapplicable; and (iv) Table 4: either Party may end this DPA as set out in Section 19 of the UK SCCs. For transfers of Personal Data that are subject to the FADP, the EU SCCs form part of this DPA as set forth in Section 9(b) of this DPA, but with the following differences to the extent required by the FADP: (i) references to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR; (ii) the term “member state” in EU SCCs shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; and (iii) the relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the supervisory authority identified in the EU SCCs (where the FADP and GDPR apply, respectively). *** # Attachment A-1 ## List of Parties ***Data Exporter.*** The data exporter is Subtotal. Subtotal provides Services to data importer pursuant to their underlying Agreement. * Address: As provided in the Agreement. * Contact person’s name, position, and contact details: As provided in the Agreement. * Activities relevant to the data transferred under these Clauses: The data exporter provides Services to data importer pursuant to their underlying Agreement. * Role: Controller ***Data Importer.*** The data importer is Customer. Customer receives Services from data exporter pursuant to their underlying Agreement. * Address: As provided in the Agreement. * Contact person’s name, position, and contact details: The contact information and name of the individual who electronically signed the Agreement. * Activities relevant to the data transferred under these Clauses: The data exporter provides Services to data importer pursuant to their underlying Agreement. * Role: Controller ***Signature and Date.*** The Parties agree that execution of the Agreement shall constitute execution of Annex I(A) of the EU SCCs by both Parties. ## Description of Transfer ***Categories of Data Subjects whose personal data is transferred.*** Any individuals whose Personal Data is processed by Subtotal or Customer in connection with the Services under the Agreement. ***Categories of personal data transferred.*** Any Personal Data related to the Data Subjects referenced above pursuant to the Agreement. ***Sensitive data transferred.*** N/A ***The frequency of the transfer.*** Continuous. ***Nature of the Processing.*** Data Exporter’s Processing activities shall be limited to those discussed in the Agreement and this DPA and will include activities such as collecting, handling, storing, transmitting, and deleting Personal Data. ***Purpose(s) of the data transfer and further Processing.*** To provide the Services to Customer. ***The period for which the Personal Data will be retained.*** Personal Data will be retained for the period of time necessary to provide the Services under the Agreement, this DPA, and/or in accordance with applicable legal requirements. ***For transfers to (sub)processors, also specify subject matter, nature and duration of the processing.*** Not relevant to Controller to Controller transfers. ## Competent Supervisory Authority To the extent legally permitted, the Irish Data Protection Authority. *** # Attachment A-2: Data Security Measures The Parties will implement and maintain the following administrative, technical, physical, and organizational security measures for the Processing of Personal Data: * ***Information Security Policies and Standards.*** The Parties maintain written information security policies, standards, and procedures addressing administrative, technical, and physical security controls and procedures. These policies, standards, and procedures are kept up to date and revised on a regular basis. * ***Physical Security.*** Where relevant, the Parties maintain commercially reasonable security systems at all physical sites at which an information system that uses or stores Personal Data is located (“**Processing Locations**”) that include reasonably restricting access to such Processing Locations, and implementing measures to detect, prevent, and respond to intrusions. * ***Organizational Security.*** The Parties maintain information security policies and procedures addressing acceptable data use standards, data classification, and incident response protocols. * ***Network Security.*** The Parties maintain commercially reasonable information security policies and procedures addressing network security. * ***Access Control.*** The Parties agree that: (1) only authorized personnel can grant, modify, or revoke access to information systems that Process Personal Data, and (2) they have implemented commercially reasonable physical and technical safeguards to create and protect access credentials. * ***Virus and Malware Controls.*** The Parties protect Personal Data from malicious code and maintain antivirus and malware protection software on all systems that handle Personal Data. * ***Personnel.*** The Parties have implemented and maintain security awareness programs to train employees about their security obligations. Employees follow established security policies and procedures, and are subject to discipline if they fail to adhere to relevant policies and procedures. * ***Subprocessor Security.*** The Parties only select and contract with Subprocessors that are capable of maintaining appropriate security safeguards that are no less onerous than those contained in the DPA and this Attachment. * ***Business Continuity.*** The Parties implement disaster recovery and business interruption plans that are kept up to date and revised on a regular basis. Subtotal also adjusts its Information Security Program in light of new laws and circumstances, and as its business and Processing practices evolve. # Customer Privacy Policy Source: https://legal.subtotal.com/legal/customers/privacy-policy This Privacy Policy describes how we at Subtotal, Inc. (“**Subtotal**”, “**we**”, “**our**”, or “**us**”) collect, use, and disclose information about our business customers (“**Customers**”), prospective customers, and visitors to our website (collectively, “**you**” or “**your**”) with respect to identifiable data that we collect from or about you (“**Personal Data**”) when you visit or use our website, online tools, applications, or services (collectively, “**Services**”), or otherwise interact with us. This Policy does not apply to information we collect about end users—for example, when they connect their Retailer accounts to Customer apps or websites through Subtotal. Please see our [**End User Privacy Policy**](https://www.subtotal.com/legal/end-users/privacy-policy) for information about our practices regarding end user data. Subtotal is the “data controller” or “business” with respect to the collection and processing of your information through the Services. If you are a Customer, your use of our Services is subject to our [**Services Agreement**](https://www.subtotal.com/legal/customers/services-agreement), which incorporates this Privacy Policy. Any terms we use in this Privacy Policy without defining them have the definitions given to them in the Services Agreement. We may update this Policy from time to time. We will alert you of material changes by giving notice on the Subtotal website, by sending you an email, or by other means as may be appropriate or required by law. By using the Services after any changes to this Policy have been posted, you agree to all of the changes. ## Personal Data We Collect ***Personal Data you provide.*** We collect Personal Data that you provide directly to us. For example, you provide certain Personal Data when you create a Customer Account, enter into a contractual relationship with us (individually or on behalf of a company or other legal entity), fill out a “contact us” form, enroll in billing, or otherwise communicate with us. The types of Personal Data we collect include: * *Customer Account Information.* We collect Personal Data that you provide when you register for a Customer Account, including account credentials (such as your password), professional information (such as your company name, company URL, and job title), and identifiers (such as your name, email address, and phone number). * *Payment Information.* We collect payment information that you provide when you sign up for our Services. We use third-party payment processors to process the payments you make to us. As such, you provide payment information directly to the third-party processor. You should review the processor’s privacy notice to learn how they treat your information. We receive only the last 4 digits of your credit card number and transaction-related information such as payment date, amount, card type, device type, and IP address. * *Communications.* When you contact us through any mode of communication, such as email or a “contact us” form on our website, we may collect your name, email address, address, phone number, company name, account ID, and other Personal Data you provide to us. We may also collect information from you in connection with customer service calls. Please note that our written and verbal communications with you may be recorded and stored by us and vendors on our behalf for training and internal business purposes. ***Personal Data we collect when you link your own Retailer account.*** Customers who use our Services often link their own Retailer accounts to test and evaluate our technology. If you do this, the collection of your information in this circumstance will be covered by our [**End User Privacy Policy**](https://www.subtotal.com/legal/end-users/privacy-policy), and not this Policy. Please see the End User Privacy Policy for details on how we collect and handle that information. ***Personal Data we collect automatically when you use our Services.*** When you use our Services, we collect the following Personal Data: * *Log Information.* We collect information that your browser or device automatically sends when you use our Services. Log information includes your IP address, browser type and settings, the date and time of your request, and how you interact with our Services. * *Device Information.* We collect information about the device you use to interact with our Services, such as the name of the device, the hardware model and operating system, IP address, domain server, the date and time of your interaction with the Services, timezone setting and location, and other technical information about the device. The information we collect may depend on the type of device you use and its settings. * *Location Information.* We may determine the general area from which your device accesses our Services based on information such as its IP address. * *Service Usage Information.* When you interact with certain features of our Services, such as AI-powered query and data analysis tools, we collect information about your use of those features, including the queries you submit, how your queries are processed internally to retrieve results, the tools or features used, and related details such as the scope of data accessed, the size of the response, and how long the request took to process. * *Cookies and Similar Technologies.* As described more fully in our [**Cookie Policy**](https://www.subtotal.com/legal/general/cookie-policy), we use cookies and other related technologies in operating our Services⁠. ***Personal Data we collect from other sources.*** We may collect Personal Data about you from other sources, such as vendors who help us identify new potential customers, including your name, email address, and social media profile URL. ***De-identified data.*** We may de-identify information we collect so the information can no longer reasonably identify you or your device, or we may collect information that is already in de-identified form. Our use and disclosure of de-identified information is not subject to any restrictions under this Privacy Policy, and we may use and disclose it to others for any purpose, without limitation. ## How We Use Your Personal Data We may use the Personal Data we collect for the following purposes, as applicable: * To fulfill our contractual obligations and provide the Services you have requested; * To operate, improve, and personalize our Services; * To promote and sell our Services; * To track opportunities and generate leads; * To bill you for our Services; * To respond to your communications with us, including support requests; * To communicate with you about our products, services, offers, and events; * To send you legal and technical notices, updates, security alerts, and messages about your account; * To prevent and investigate fraud and other illegal activities; * To monitor, test, and update our Services, and diagnose and fix technical problems; * To maintain the security and integrity of our Services and property; * To enforce our contractual rights, resolve disputes, and protect the rights, privacy, safety, and property of Subtotal and others; and * To comply with our legal obligations. We do not use Personal Data or End User Data to train artificial intelligence or machine learning models. ## Online Analytics and Advertising ***Online Analytics.*** As discussed in greater detail in our Cookie Policy, we may use third-party analytics in connection with our Services (e.g., analytics platforms such as Google Analytics or PostHog). These vendors may set and access their own cookies, pixel tags, and similar technologies on our Services and on third-party services to collect information that can be used to track users over time and across services. These analytics tools help us understand how users arrive at and use our Services. If you do not want Google Analytics to collect and use information about your use of our Services, then you can [install an opt-out](https://tools.google.com/dlpage/gaoptout) in your web browser. You also may opt-out from Google Analytics for Display Advertising or the Google Display Network by using Google’s [ads settings](https://www.google.com/settings/ads). ***Online Advertising.*** We strive to provide you with relevant, value-added content in our online advertisements. We work with online analytics and advertising partners to: (i) better understand the use of our Services so that we can improve them; and (ii) deliver advertisements that are more tailored to you both on our Services and on third-party apps and websites. Our partners may place cookies, pixel tags, and similar technologies on many online services, including ours. They use these technologies to collect information about your activities on these services in order to deliver you more relevant advertising. For example, they may use the information they collect from their cookies on our Services to identify products and services you might be interested in. For information about how to opt out of receiving personalized online advertisements from our advertising partners, follow the instructions in the “Your Rights and Choices” section below. Please visit our [Cookie Policy](https://www.subtotal.com/legal/general/cookie-policy) for more details. ## How We Disclose Your Personal Data We disclose your Personal Data as follows: * With service providers, agents, and contractors who provide services for us, such as payment processors, web hosting providers, data storage providers, email and messaging communications providers, analytics providers, artificial intelligence and machine learning service providers, and customer relationship and support providers; * With advertisers and other third parties who use cookies and related technologies to collect information about your use of the Services (see our [Cookie Policy](https://www.subtotal.com/legal/general/cookie-policy) and the “Online Advertising and Analytics” section above for more details); * To comply with our legal obligations and with legal or regulatory processes (such as subpoenas); * To prevent fraud, malicious activity, and other privacy and security-related concerns or otherwise protect the rights, property, and safety of you, end users, Retailers, Subtotal, and others; * With third parties in relation to a change in ownership or control of all or a part of our business or assets, or in contemplation thereof, such as a merger, acquisition, bankruptcy, or reorganization; and/or * Between and among Subtotal and our current and future parents, affiliates, and subsidiaries. We may also collect, use, and disclose aggregated, de-identified, or anonymized information that does not identify you personally for any purpose permitted by law. ## Your Responsibility for End User Data This Privacy Policy governs how we collect, use, and disclose your Personal Data. It does not govern the End User Data that we make available to Customers through the Services. If you are a Customer, then as set forth in our [**Services Agreement**](https://www.subtotal.com/legal/customers/services-agreement), you are solely responsible for all downstream uses of End User Data by you, your Service Providers, and any other third parties that receive End User Data from or through you, whether directly or indirectly, including ensuring that such use complies with applicable data protection and security laws and the terms of the Services Agreement. ## Data Security We seek to protect your Personal Data from unauthorized access, use, and disclosure. We maintain a variety of physical, technical, and administrative security measures appropriate to the risk associated with the processing of your Personal Data. Unfortunately, no data transmission or storage system is completely secure. For additional information about our security practices, please visit our [Security Page](https://security.subtotal.com/). ## ​Data Retention We retain your Personal Data for as long as necessary to provide our Services and to fulfill the purposes for which we collected it, including for the purposes of complying with our legal obligations, resolving disputes, and collecting fees. When establishing a retention period for specific categories of information, we consider who we collected the information from, our need for the information, our reason for collecting the information, and the amount and sensitivity of the information. Once the applicable retention period has come to an end, we will take commercially reasonable steps to destroy, overwrite, de-identify, aggregate, or anonymize your Personal Data so that it can no longer be reasonably linked to you. If we aggregate, de-identify, or anonymize information such that it can no longer be used to identify you personally, we may use that information indefinitely without further notice to you. ## Information for International Users We and our processors operate in the United States and may transfer, store, and/or process your information in the United States for the purposes described in this Privacy Policy. Please note that the data protection laws in the United States may be different from those in your jurisdiction of residence (e.g., Canada). Wherever your information is transferred, stored, or processed by us or our processors, we take reasonable steps to protect your information in accordance with this Privacy Policy and applicable laws. These measures may include implementing model clauses to govern the transfer of your information, or other means recognized by applicable laws. By providing us with your information, you acknowledge any such transfer, storage, or processing. If you have any concerns or complaints about our data processing activities, we urge you to first try to resolve such issues directly with us by contacting us using the information below. However, if applicable, you may make a complaint to the data protection supervisory authority in the country where you are based (e.g., the Commission d’accès à l’information (CAI) in Quebec), or seek a remedy through local courts if you believe your rights have been breached. ## Your Rights and Choices ***Your Choices*** * *Customer Account Information.* If you have a Customer Account, you may update your Customer Account information by logging into your account on our website or by contacting us. * *Cookies.* You can find more information about how we use cookies and your related choices in our [**Cookie Policy**](https://www.subtotal.com/legal/general/cookie-policy). * *Marketing Communications.* In accordance with applicable law, we may send you marketing communications. You may opt out of receiving marketing emails from Subtotal by following the instructions in those emails. If you opt out, we may still send you other types of emails, such as legal notices and support, service, and other emails regarding your account. ***Your Rights*** Regardless of where you live, we recognize, and you may exercise, the following rights with respect to your Personal Data, subject to applicable exceptions provided by law: * *Information.* To request information about the categories of Personal Data we have collected, the sources from which we collected the data, and how we have used and disclosed your Personal Data; this information is contained in this Privacy Policy. * *Access.* To access a copy of the Personal Data we have collected from and about you in a structured, commonly used technological format. * *Portability.* To have your Personal Data transferred to a third party, where technically feasible. * *Deletion/de-indexing.* To request that we delete/de-index the Personal Data we have collected from and about you. * *Opt Out.* To request to opt out of: * The “sale” of your Personal Data; * The “sharing” or “processing” of your Personal Data for online targeted advertising purposes; * The use of automated decision-making regarding your Personal Data, where such processing results in legal or similarly significant impacts (note that we have not engaged in such processing over the prior 12 months); and * The use of your “sensitive” Personal Data, in certain circumstances (note that we do not process “sensitive” Personal Data in a way that is subject to this opt out right). * *Nondiscrimination and non-retaliation.* To exercise these rights free from discrimination or retaliation. * *Withdrawal of consent.* If the basis on which we are processing your Personal Data is consent, you have the ability to withdraw such consent. Oregon, Connecticut, and Minnesota residents can also request a list of the specific third parties, other than natural persons, to which we have disclosed personal information. ***Exercising Your Rights*** You can exercise the rights described in this section by submitting a request to [privacy@subtotal.com](mailto:privacy@subtotal.com)⁠. You may be required to provide additional information to confirm your identity before we can respond to your request. If an authorized agent submits a request on your behalf, we may ask for a valid power of attorney to verify that the agent has written authority to submit requests on your behalf. In certain cases, we may be required or permitted by law to deny your request. To opt out of our use of cookies/pixels in ways that could be considered “sales” or “processing” for “online targeted advertising,” please see the “Online Advertising and Analytics” section above. If we deny your request in whole or in part, you also have the right to appeal our denial. You can exercise this right by emailing us at [privacy@subtotal.com](mailto:privacy@subtotal.com) or contacting us as provided below. Your description must include your full name and the email address used for your account with us (if applicable), along with a copy of the denial notice you received from us. ## Additional Information for California Residents If you are a California resident, we agree, in response to your request, to provide you with information about: * The purpose for which we use each category of “personal information” (as defined in the CCPA) we collect; and * The categories of third parties to which we (a) disclose such personal information for a business purpose, (b) “share” personal information for “cross-context behavioral advertising,” and/or (c) “sell” such personal information. Under the CCPA, “sharing” is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across distinct online services, and “selling” is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. We “share” information with our advertising partners to provide more relevant and tailored advertising to you regarding our Services. Moreover, our use of third-party analytics services and online advertising services may result in the sharing of online identifiers (e.g., cookie data, IP addresses, device identifiers, and usage information) in a way that may be considered a “sale” under the CCPA. In the past 12 months, we have processed the categories of personal information listed in the table below. For each category, the table provides the source, business purpose, and general categories of third parties to whom the information may be disclosed. For more detailed information, please see the Personal Data We Collect,” “How We Use Your Personal Data,” and “How We Disclose Your Personal Data" sections above. | Personal Information Category | Business Purpose of Use | Third Parties to Whom Information is Disclosed | Third Parties to Whom Information is Sold/Shared | | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | Identifiers (e.g., name, email address, address) | | | | | Commercial information (e.g., records of your purchase of Services from us) | | | | | Professional Information (e.g., company, title, and role) | | | | | Payment Information (collected and stored by a third-party payment processor on our behalf) | | | | | Internet or other similar network activity (including usage information) | | | | | Geolocation data (e.g., physical location at the city/state level) | | | | | Inferences drawn from other information | | | | | Sensory data (e.g., photos or videos you provide in reviews, customer service call recordings for quality assurance) | | | | | Account log-in credentials | | | | ***Your Choices Regarding “Sharing” and “Selling.”*** You have the right to opt out of the sale or sharing of your personal information for online analytics and advertising purposes. You can exercise this right by contacting us as described in the “Your Rights and Choices” section above. We also honor browser-based opt out signals, such as the global privacy control, in accordance with our legal obligations. ***Other CCPA Rights.*** For information about the additional rights you have under California law and how to exercise them, please see the “Your Rights and Choices” section above. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate disclosures at that time. The CCPA also gives California residents the right to limit the use and disclosure of their “sensitive personal information” (as defined in the CCPA) if such information is used for certain purposes. However, we do not use or disclose sensitive personal information for purposes that would trigger this right to limit. ***Retention of Your Personal Information.*** Please see the “Data Security” and “Data Retention” sections above. ***Do Not Track.*** Do Not Track (“**DNT**”) is a privacy preference that users can enable in certain web browsers. While we are committed to providing meaningful choices about the information collected on our Services for third-party purposes—including through the opt-out mechanisms described above—we do not currently recognize or respond to browser-based DNT signals. Learn more about DNT at [https://www.allaboutdnt.com](https://www.allaboutdnt.com/). ***California “Shine the Light” Disclosure.*** Under California Civil Code Sections 1798.83-1798.84, California residents have the right, in certain circumstances, to request that we do not disclose certain categories of personal information to third parties for their direct marketing purposes, or alternatively, that we maintain a policy to provide a cost-free means of opting out of such disclosures. We maintain such an opt out policy. To make an opt out request, please contact us using the contact information below and include “California Shine the Light Request” in the email subject line. ## Contact Us If you have any questions or comments about this Privacy Policy, our collection and use of your Personal Data, or your rights and choices regarding such collection and use, please contact us at: [**https://www.subtotal.com/**](https://www.subtotal.com/)\ **[legal@subtotal.com](mailto:legal@subtotal.com)**\ 100 Church Street, Suite 800\ New York, NY 10007 We have also appointed Workstreet to act as Subtotal's representative in the European Union for data protection matters, in accordance with Article 27 of the General Data Protection Regulation. If you are in the European Economic Area, Workstreet should be contacted in addition to [privacy@subtotal.com](mailto:privacy@subtotal.com) on matters related to the processing of personal data, including Data Subject Requests. To submit an inquiry, please contact: [ria@workstreet.com](mailto:ria@workstreet.com). # Services Agreement Source: https://legal.subtotal.com/legal/customers/services-agreement This Services Agreement (“**Agreement**”) is a legally binding contract between Subtotal, Inc. (together with our affiliates, “**Subtotal**,” “**we**,” “**our**,” or “**us**”), and any customer (“**Customer**,” “**you**,” or “**your**”) that uses our online tools, integrations, application programming interfaces (“**APIs**”), web-based or mobile applications, and related services (collectively, the “**Services**”) whether accessed through our website located at [https://www.subtotal.com/](https://www.subtotal.com/) (the “**Website**”) or through any other means of access we provide. For Customers that access the Services pursuant to an Order Form (including paying Customers and Customers using the Services on a trial or promotional basis), this Agreement is effective as of the effective date set forth in the first Order Form between you and Subtotal (the “**Effective Date**”). Upon mutual execution, each Order Form is incorporated into and forms a part of this Agreement; an Order Form presented electronically through the Services (including any online registration or subscription page) is deemed mutually executed when Customer accepts it through the Services and Subtotal makes the Services available under it. By creating or administering a Customer Account, accessing our Services, or executing an Order Form, you agree to be bound by this Agreement as well as our [Customer Privacy Policy](https://www.subtotal.com/legal/customers/privacy-policy) and [Data Protection Addendum](https://www.subtotal.com/legal/customers/data-protection-addendum), both of which are incorporated into and form a part of this Agreement. ## 1. Definitions 1.1. **”Additional Usage Fees”** means the fees, if any, payable by Customer for usage of the Services in excess of the Included Usage, calculated at the rate(s) set forth in the applicable Order Form. The Order Form may specify Additional Usage Fees for one or more usage metrics (such as Connections, Purchases, MCP Queries, Events, or API Requests). 1.2. **”API Request”** means an individual HTTP request submitted to an endpoint of the Subtotal API, regardless of the response. 1.3. **”Authorized User”** has the definition given in Section 3.1. 1.4. **”Connection”** means a link established by an End User between the End User’s Retailer account and Customer, through Subtotal Link or another mechanism made available as part of the Services. 1.5. “**Customer Account**” has the definition given in Section 3.1. 1.6. “**Customer Content**” has the definition given in Section 5.2. 1.7. “**End User**” means an end user of Customer’s platform, products, or services. 1.8. “**End User Data**” means data acquired from or about End Users that is provided, uploaded, submitted, or otherwise collected through the Services and made available by Subtotal to Customer or its Service Providers, but only: (i) with respect to Purchases made available to Customer, and Connections established or maintained, during the Subscription Term (including identity and contact information associated with the End User’s Retailer account, whether or not any Purchase is associated with that Connection); (ii) in accordance with any disclosure limitations or privacy preferences indicated by End Users; (iii) as limited by any disclosure preferences specified by Customer in, and any access or usage limitations set forth in, the applicable Order Form; and (iv) as permitted by applicable law (including exclusions for data deemed “sensitive” under data protection laws). 1.9. “**Event**” means any discrete outbound data transmission sent by Subtotal to Customer or to a third-party in connection with Customer’s use of the Services, including but not limited to (i) each webhook request, (ii) each individual record (such as a row, object, or equivalent unit of data) transmitted as part of a data export or sync, and (iii) each record or message transmitted to a third-party integration that Customer has enabled (such as a loyalty, messaging, or analytics platform). A single underlying activity (such as a single Purchase) may generate multiple Events where Customer has enabled multiple webhooks or integrations. 1.10. “**Fees**” has the definition given in Section 4.1. 1.11. “**Included Usage**” means the usage included in Customer’s plan as specified in the applicable Order Form that Customer may access during the period of time specified in such Order Form without incurring Additional Usage Fees. 1.12. “**MCP Query**” means a discrete request to retrieve or process data that is executed in connection with Customer’s or an Authorized User’s use of an MCP server made available by Subtotal as part of the Services. A single user prompt may result in multiple MCP Queries. 1.13. “**Order Form**” means an ordering document for the Services, including any online registration or subscription page presented through the Services, that references this Agreement and sets forth the applicable terms agreed between the parties. 1.14. “**Purchase**” means a purchase transaction made by an End User through a Retailer account that the End User has linked to Customer’s application or website using the Services, where such transaction includes at least one product sold under a Subscribed Brand. 1.15. “**Renewal Term**” has the meaning given in Section 14.1. 1.16. “**Retailer**” means a retailer (such as Amazon, Walmart, or Target) supported by the Services. 1.17. “**Service Providers**” means “service providers” and/or “processors” as such terms are defined under applicable data privacy and security laws. 1.18. “**Subscribed Brand**” means a brand for which Customer has subscribed, as indicated on an Order Form. 1.19. “**Subscription Term**” means the period of time specified in the applicable Order Form during which Customer is authorized to access and use the Services, together with any Renewal Terms. ## 2. Services 2.1. ***Eligibility.*** You may use the Services only if you are able to form a binding contract with Subtotal (either on your own behalf or on behalf of the entity you represent), and only in compliance with the Agreement and all applicable local, state, national, and international laws, rules, and regulations. Any use of or access to the Services by individuals under the age of 18, except to view the Website, is strictly prohibited. The Services are also not available to any Customer previously removed from the Services by Subtotal. By registering a Customer Account or executing an Order Form, you represent and warrant that (a) you are at least 18 years of age, (b) you will use the Services in accordance with this Agreement and all applicable laws, and (c) if registering or executing an Order Form on behalf of a company or other entity, you are an authorized representative of and have the authority to bind such entity to this Agreement. 2.2. ***License.*** During the applicable Subscription Term and subject to the terms of this Agreement, we grant you a non-exclusive, non-sublicensable, non-transferable license to access and use the Services solely for your internal business purposes. 2.3. ***Restrictions.*** Except as expressly set forth in this Agreement, you will not (and will not allow anyone else to): (a) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code or underlying ideas or algorithms of the Services; (b) copy, modify, translate, or create derivative works of the Services; (c) provide, sell, transfer, assign, sublicense, lend, distribute, rent, or otherwise allow others to access or use the Services; (d) use the Services for the benefit of any third party or to commercially perform, distribute, or exploit the Services other than as expressly permitted; (e) conduct security or vulnerability tests on, interfere with the operation of, cause performance degradation of, or circumvent access or other technical restrictions of the Services; (f) remove or alter any proprietary notices or labels; (g) access accounts, information, data, or portions of the Services to which you do not have authorized access; (h) use the Services to develop a competitive product; (i) benchmark, test, or analyze the Services for competitive purposes; (j) use the Services for or with any activity prohibited by law; (k) upload, submit, or otherwise make available to us any data or information to which you do not have the proper rights; or (k) use End User Data except as expressly permitted in this Agreement and applicable law. Subtotal may restrict, delay, or limit any use of the Services, including the number or frequency of API calls or requests, that could damage, disable, overburden, impair, or otherwise interfere with the operation, security, integrity, or availability of the Services. Subtotal will use commercially reasonable efforts to notify Customer of any such restriction and will work in good faith with Customer to address Customer’s reasonable business needs while maintaining the stability and security of the Services. 2.4. ***Changes to the Services.*** Subtotal may make improvements and modifications to the Services from time to time, including by adding, modifying, or removing features or functionalities. If Subtotal makes a material change that reduces the overall functionality of the Services, Subtotal will provide Customer with prior notice. Subtotal will not be liable for any such modifications, provided that the Services continue to perform in all material respects as described herein. ## 3. Customer Account 3.1. ***Authorized Users.*** We will provide you with access to an account through the Services (“**Customer Account**”), subject to your obligation to pay any applicable Fees as and when they become due under this Agreement and the applicable Order Form. You may authorize certain of your employees, subcontractors, and other agents (collectively, “**Authorized Users**”) to access and use the Services on your behalf, provided that you shall remain fully responsible for all such access and use, including, without limitation, each Authorized User’s compliance with this Agreement, including the scope of the license, the use restrictions, and your confidentiality obligations. You will ensure that only Authorized Users use the Services through your Customer Account. You are responsible for any activity that occurs on your Customer Account, including with respect to Customer Content (other than as a result of Subtotal’s willful misconduct), and for keeping the Customer Account and login credentials secure. You agree to notify us immediately of any actual or suspected unauthorized use of the Services under or in connection with your Customer Account. 3.2. ***Service Providers and Partners.*** As a data controller under applicable data protection laws, Customer is responsible for the activities of any Service Providers and/or third-party partners (“**Customer Partners**”) that it authorizes to access, collect, or process End User Data on its behalf, including through integrations within the Services. Customer represents and warrants that it has provided any legally required notice, and obtained any legally required End User consent or has another lawful basis permitting Subtotal to disclose or make available End User Data to such Service Providers and/or Customer Partners (or that such Service Providers and/or Customer Partners have obtained such consent directly or have another lawful basis for accessing or receiving End User Data). 3.3. ***Account Suspension.*** Subtotal reserves the right to suspend, deactivate, or replace your Customer Account if it determines that the account has been, or may have been, used for an unauthorized purpose. To the maximum extent permitted by law, Subtotal will not be liable for any losses arising from the unauthorized use of a Customer Account. ## 4. Fees; Payment 4.1. ***Fees.*** In consideration of the rights granted under this Agreement, Customer will pay Subtotal the base platform fee set forth in the applicable Order Form (together with any Additional Usage Fees, the “**Fees**”). Each Order Form will specify, for each applicable usage metric, the Included Usage, the time period applicable to such Included Usage, and the rate at which Additional Usage Fees (if any) will be calculated for usage in excess of the Included Usage. Any Included Usage not consumed during the applicable period shall expire at the end of such period and shall not roll over to any subsequent period. If Customer exceeds the Included Usage during the applicable period, Customer will incur Additional Usage Fees for such excess usage, which will be invoiced and charged monthly in arrears. 4.2. ***Fee Increases.*** Subtotal may, in its sole discretion, modify the Fees from time to time. For the avoidance of doubt, modifying the Fees includes establishing or increasing the Additional Usage Fee for any usage metric, including any metric for which the prior Order Form specified no Additional Usage Fee. Any such change will become effective at the start of the next Renewal Term. Subtotal will provide Customer with reasonable prior written notice of any Fee change to allow Customer an opportunity to elect not to renew before the change takes effect. Fees may also be adjusted if Customer no longer qualifies for a discount, whether because of changes in the quantities purchased or the length of the Subscription Term or because Customer ceases to satisfy any other condition of eligibility for that discount stated in the applicable Order Form. Except as expressly provided in this Agreement, all payments are non-cancelable and non-refundable. Any permitted suspension of the Services by Subtotal pursuant to the terms of this Agreement will not relieve Customer of its payment obligations. 4.3. ***Billing Cadence.*** Unless otherwise specified in this Agreement or in an Order Form, Fees are billed in advance on a recurring basis and charged automatically to Customer’s designated payment method (via Stripe or another platform selected by Subtotal). Billing occurs on the Effective Date and recurs on the same day of each subsequent billing cycle (monthly or annually, as applicable) during the Subscription Term. 4.4. ***Payment Terms.*** Customer’s payment obligations are absolute and not subject to any setoff claims or rights of offset of any kind. If any automatic payment of undisputed Fees is declined or otherwise fails, Customer will have ten (10) days from the due date to remedy such failure. Without limiting Subtotal’s other rights and remedies, if Customer does not cure within that period, then (a) Subtotal may suspend Customer’s access to the Services upon notice, (b) Subtotal may elect to charge interest on overdue amounts at a rate of 1.5% per month (or the maximum rate permitted by law), and (c) Customer will reimburse Subtotal for any reasonable third-party costs of collection, including attorneys’ and professionals’ fees. 4.5. ***Payment Disputes.*** If Customer believes that a charge has been made in error, Customer must notify Subtotal within thirty (30) days of the charge, specifying the basis of the dispute in reasonable detail. Failure to provide such notice will constitute a waiver of Customer’s right to dispute the charge. The parties will work together in good faith to resolve any payment disputes, and Customer will pay all undisputed amounts when due. 4.6. ***Taxes.*** Customer will be responsible for all duties, levies, and taxes (including sales tax) imposed on the Fees by any governmental authority, other than taxes based on Subtotal’s net income. All automatic charges and payments under this Agreement will be processed exclusive of such taxes. If applicable law requires Customer to withhold or deduct taxes (for example, international withholding taxes), Customer will pay such additional amounts as are necessary to ensure that Subtotal receives the full amount of Fees as if no such withholding or deduction had been required. Subtotal will provide Customer with any tax forms reasonably requested to reduce or eliminate applicable withholding or deduction obligations. If any portion of Customer’s activities is tax exempt, (i) Customer will provide Subtotal a copy of Customer’s exemption certificate, and (ii) this Section 4.6 will not apply to the extent Customer’s use of the Services falls within the scope of such exemption. 4.7. ***Free Trials & Promotions.*** Subtotal may offer the Services on a trial or promotional basis, free of charge or at a discounted rate. Any such trial or promotional subscription is subject to the applicable terms presented at sign-up and will, in accordance with those terms, either terminate or convert automatically into a paid subscription without further action by either party. During the promotional period, your right to use the Services is limited and may be suspended or terminated at any time at Subtotal’s discretion. You may cancel your promotional subscription at any time during the promotional period by providing written notice to Subtotal.‍ 4.8. ***Beta Services.*** From time to time, Subtotal may make available to Customer services or functionality that are not generally available to Subtotal customers or that are designated as alpha, beta, pilot, preview, or another pre-release designation (“**Beta Services**”). Beta Services are not part of the “Services” under this Agreement and may be modified, suspended, or discontinued at Subtotal’s sole discretion. Customer acknowledges and agrees that Beta Services (a) are provided solely on an “AS IS” and “AS AVAILABLE” basis; (b) are not final products and may contain defects, bugs, errors, or other issues; and (c) are provided without any warranties of any kind, express or implied. CUSTOMER ASSUMES ALL RISKS AND COSTS ASSOCIATED WITH ITS USE OF THE BETA SERVICES, INCLUDING WITHOUT LIMITATION ANY INTERNET ACCESS FEES, BACK-UP EXPENSES, COSTS INCURRED FOR THE USE OF YOUR DEVICE AND PERIPHERALS, AND ANY DAMAGE TO ANY EQUIPMENT, SOFTWARE, INFORMATION, OR DATA. Subtotal has no obligation to maintain or provide technical or other support for the Beta Services. ## 5. Intellectual Property Ownership and Licenses 5.1. ***Services.*** The Services, including the text, graphics, images, and other content contained therein, and all intellectual property rights therein and thereto, are owned by Subtotal or our licensors. Except as explicitly stated in this Agreement, all rights in and to the Services, including all intellectual property rights therein and thereto, are reserved by us or our licensors. 5.2. ***Customer Content.*** As between Subtotal and Customer, Customer owns all intellectual property rights in and to any data, information, or materials Customer (or Customer’s employees, contractors, or agents) provide, upload, or submit in the course of using the Services (the “**Customer Content**”). Customer hereby grants Subtotal a non-exclusive, transferable, worldwide, royalty-free license, with the right to sublicense, to host, cache, store, reproduce, transmit, modify and otherwise use, the Customer Content (including Customer logos and brand names) to provide and improve the Services and related offerings. Without limiting the foregoing, you acknowledge and agree that Subtotal and its licensors may use Customer Content to develop, train, or enhance any artificial intelligence or machine learning models that are part of our products and services, including third-party components of the Services. 5.3. ***End User Data.*** Subtotal licenses certain rights in End User Data from End Users in order to provide the Services. Subject to the terms of this Agreement, Subtotal grants Customer a non-exclusive, non-transferable, non-sublicensable license to access and use such End User Data, at all times in compliance with applicable data privacy and security laws, solely to deliver personalized experiences that benefit End Users (e.g. rewards, promotions, rebates, and advertisements and offers) and for Customer’s other internal, legitimate business purposes, and not for distribution or resale to third parties. For the avoidance of doubt, Customer may disclose End User Data to its Service Providers and/or Customer Partners to the extent permitted under Section 6.2 and subject to the requirements set forth therein. Customer is solely responsible for all downstream uses of End User Data by Customer, its Service Providers, and any other third parties that receive End User Data from or through Customer, whether directly or indirectly. 5.4. ***Feedback.*** Customer may from time to time provide suggestions, comments, or other feedback to Subtotal, including suggestions for product or service offerings, changes, improvements, or new functionality or capabilities (“**Feedback**”). Feedback is entirely voluntary, and Subtotal is not required to treat Feedback as Confidential Information of Customer and will be free to use Feedback and ideas generated from Feedback for the improvement of the Services and for Subtotal’s future product development and otherwise without restriction, attribution, or compensation to Customer. To the extent a license is required under Customer’s intellectual property rights to make use of the Feedback, Customer hereby grants Subtotal an irrevocable, non-exclusive, perpetual, royalty-free license to use the Feedback in connection with Subtotal’s business, including the enhancement of the Services. 5.5. ***Reservation of Rights.*** Except as otherwise set forth in this Agreement, each party retains all right, title, and interest in and to its intellectual property. ## 6. Data; Data Privacy 6.1. ***Customer Data.*** Subtotal will process any Personal Data (as defined in our [Customer Privacy Policy](https://www.subtotal.com/legal/customers/privacy-policy)) contained in the Customer Content in accordance with our [Customer Privacy Policy](https://www.subtotal.com/legal/customers/privacy-policy). 6.2. ***End User Data and Service Providers.*** Customer and Subtotal shall each process End User Data as independent controllers in accordance with Subtotal’s [Data Protection Addendum.](https://www.subtotal.com/legal/customers/data-protection-addendum) Customer may permit certain Service Providers and/or Customer Partners to access or obtain End User Data on its behalf where such Service Providers have integrated with the Services or where Customer instructs Subtotal to disclose End User Data to such entities. Customer may also disclose End User Data directly to its Service Providers and Customer Partners. In each such event, Customer represents and warrants that: (i) it has binding agreements in place with such Service Providers and/or Customer Partners obligating them to process End User Data only on behalf of Customer or as otherwise permitted under applicable data protection and security laws; (ii) such Service Providers and/or Customer Partners will at all times process End User Data in compliance with applicable data protection and security laws; and (iii) Customer is authorized to instruct Subtotal to disclose End User Data to such Service Providers and/or Customer Partners. Customer is solely responsible for any misuse of End User Data by its Service Providers or any other third parties, including Customer Partners, that receive End User Data from or through Customer, whether directly or indirectly. Without limiting the foregoing, Customer is responsible for ensuring that any such third parties process End User Data only for purposes consistent with this Agreement and in compliance with applicable data protection and security laws. Customer is also solely responsible for any unauthorized access to or use of End User Data provided to Customer, its Service Providers and/or Customer Partners through the Services, unless such access or use is due to Subtotal’s gross negligence or willful misconduct. In addition, Customer shall provide End Users with a clear and easily accessible mechanism to withdraw consent or revoke any Connections established through the Services. 6.3. ***Usage Data.*** Subtotal may collect data in connection with Customer’s use of the Services, such as account information and settings, billing history, usage details, operational status, authentication details, quality and performance metrics, and other technical information necessary to operate and maintain the Services (“**Usage Data**”). Customer acknowledges and agrees that Subtotal may use such Usage Data for business purposes related to the ongoing operation, development, and improvement of the Services. Subtotal will not disclose Usage Data to any third party unless it is (a) de-identified so that it does not identify Customer, its Authorized Users, or any other person and (b) aggregated with data across other Customers. 6.4. ***De-Identified and Aggregated Data.*** Where Subtotal makes available to Customer data that has been aggregated and de-identified such that it does not identify any person, Customer will not, and will not permit or enable any Authorized User, Service Provider, or other third party to, attempt to re-identify, or to derive the identity of any person from, such data, whether by linking or combining it with other data or by any other means. ## 7. Suspension If Customer (a) fails to pay any undisputed Fees when due (including where automatic payment or charge attempts are unsuccessful); (b) breaches Section 2 of this Agreement (Services); or (c) uses the Services in a manner that negatively affects the Services or others, as determined by Subtotal in its reasonable discretion, then Subtotal may suspend Customer’s (and Customer’s Authorized Users’) access to the Services, in whole or in part, with or without notice. Subtotal may limit access to, or the availability of, particular features or functionality of the Services in lieu of suspending access in full. Subtotal may reinstate access in its sole discretion once the underlying issue has been resolved. ## 8. Third-Party Services The Services may contain links to, or integrations with, third-party websites, platforms, applications, or services (collectively, “**Third-Party Services**”). Customer’s access to and use of such Third-Party Services, including Customer’s decision to disclose or provide access to End User Data through such Third-Party Services, are governed solely by the applicable third party’s terms and conditions, and not by this Agreement. Subtotal does not own or control and is not responsible or liable for any aspect of such Third-Party Services, including without limitation their content, functionality, or practices, or for any harm, damages, or losses that may arise from Customer’s use of or interactions with any Third-Party Services. ## 9. Confidentiality 9.1. ***Confidential Information.*** “**Confidential Information**” means information in any form disclosed by or on behalf of one party to the other party in connection with this Agreement that (a) the disclosing party identifies as “confidential,” “proprietary,” or the like; or (b) should be reasonably understood as confidential or proprietary due to its nature and the circumstances of its disclosure. Confidential Information does not include information that (a) was previously known without restriction; (b) becomes publicly available through no fault of the receiving party; (c) is disclosed by a third party without restriction; or (d) is independently developed without access to Confidential Information. 9.2. ***Non-Use and Non-Disclosure.*** Except as otherwise authorized in this Agreement or as needed to fulfill its obligations or exercise its rights under this Agreement, neither party will (a) use the other party’s Confidential Information, nor (b) disclose the other party’s Confidential Information to anyone else, except as permitted below. Each party will protect the other party’s Confidential Information using at least the same protections that it uses for its own similar information but no less than a reasonable standard of care. 9.3. ***Permitted Disclosures.*** The receiving party may share the disclosing party’s Confidential Information to the extent required by law provided that the receiving party reasonably cooperates, at the disclosing party’s expense, with the disclosing party’s efforts to obtain confidential treatment for the Confidential Information. The receiving party may also share the disclosing party’s Confidential Information to employees, advisors, contractors, directors, suppliers, and agents who have a need to know the Confidential Information, but only if the person or entity is bound by confidentiality obligations at least as protective as those contained in this Section 9 (Confidentiality). ## 10. Representations and Warranties 10.1. ***Mutual.*** Each party represents and warrants that: (a) it is duly organized, validly existing, and in good standing under the laws of its jurisdiction; (b) it has the legal power and authority to enter into this Agreement; (c) this Agreement is legally binding upon it; and (d) it will comply with all applicable laws in performing its obligations or exercising its rights under this Agreement. 10.2. ***From Customer.*** If you are entering into this Agreement on behalf of a company or other entity, you represent and warrant that you have full authority to bind that entity to this Agreement. You further represent and warrant that you, your employees, contractors, and agents, and anyone else who submits or makes Customer Content available through the Services have, and will maintain, all rights necessary to do so and to permit Subtotal to use such Customer Content as described in this Agreement. You acknowledge that you are solely responsible for the accuracy, quality, and content of Customer Content and that Subtotal disclaims all liability with respect thereto. 10.3. ***From Subtotal.*** Subtotal warrants that the Services will perform in substantial conformity with the applicable [documentation](https://www.subtotal.com/docs/welcome). In the event of a breach of this warranty, Customer’s sole and exclusive remedy, and Subtotal’s entire obligation, will be for Subtotal to use commercially reasonable efforts to correct the non-conformity or provide a reasonably equivalent work-around within a reasonable time after Subtotal receives written notice from Customer of the non-conformity. This warranty does not apply to errors or issues resulting from: (a) factors or events outside of Subtotal’s control; (b) use of the Services not in accordance with this Agreement or the documentation; or (c) modifications to the Services made by anyone other than Subtotal. ## 11. Disclaimer of Warranties EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS AGREEMENT, (i) THE SERVICES ARE PROVIDED ON AN “AS-IS” AND “AS AVAILABLE” BASIS AND WITHOUT WARRANTIES OF ANY KIND, AND (ii) SUBTOTAL DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. SUBTOTAL DOES NOT WARRANT THAT THE OPERATION OF THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE. EACH PARTY ACKNOWLEDGES THAT IT HAS NOT ENTERED INTO THIS AGREEMENT IN RELIANCE UPON ANY WARRANTY OR REPRESENTATION OTHER THAN THOSE SET FORTH ABOVE IN SECTION 10. TO THE EXTENT THAT SUBTOTAL CANNOT LAWFULLY DISCLAIM EXPRESS, STATUTORY, OR IMPLIED WARRANTIES, THEN ALL SUCH WARRANTIES SHALL BE LIMITED TO THE TERM AND REMEDIES OF THE LIMITED WARRANTY IN SECTION 10 AND THE LIMITATIONS OF SECTION 12 SHALL APPLY. ## 12. Indemnification 12.1. ***Subtotal’s Indemnification of Customer.*** Subtotal will indemnify, defend, and hold harmless Customer, its affiliates, and each of its and its affiliates’ employees, contractors, directors, suppliers, and agents from all liabilities, claims, and expenses paid or payable to an unaffiliated third party (including reasonable attorneys’ fees) (“**Losses**”), that arise from or relate to any claim, suit, or proceeding by a third party (a “**Claim**”) against Customer to the extent such Claim is based upon an allegation that the Services, when used by Customer in accordance with the terms of this Agreement, violate, misappropriate, or otherwise infringe such third party’s intellectual property rights. THE FOREGOING STATES SUBTOTAL’S SOLE LIABILITY AND CUSTOMER’S EXCLUSIVE REMEDY AGAINST SUBTOTAL FOR ANY CLAIM THAT THE SERVICES INFRINGE INTELLECTUAL PROPERTY RIGHTS OF A THIRD PARTY. 12.2. ***Customer’s Indemnification of Subtotal.*** Customer will indemnify, defend, and hold harmless Subtotal and its subsidiaries, agents, licensors, managers, employees, contractors, agents, officers, and directors from and against all Losses that arise from or relate to any Claim to the extent such Claim (a) is based upon an allegation that Customer Content, when used according to the terms of this Agreement, violates, misappropriates, or otherwise infringes such third party’s intellectual property rights; (b) arises from or relates to Customer’s, its Service Providers’, or any other downstream recipient’s use of End User Data other than as expressly permitted hereunder or in breach of the representations and warranties set forth herein; (c) arises or relates to any breach by Customer of Section 2 (Services); or (d) arises from or relates to any agreement, written or otherwise, between Customer and an End User. 12.3. ***Procedure.*** The indemnifying party’s obligations in this section are contingent upon the protected party: (a) promptly notifying the indemnifying party, in writing, of each Claim for which it seeks protection; (b) providing reasonable information and assistance to the indemnifying party at the indemnifying party’s expense; and (c) giving the indemnifying party sole control over the defense and settlement of any claim, provided that the protected party may participate in such defense and settlement at its own expense. Notwithstanding the foregoing, the indemnifying party may not agree to any settlement of a claim that contains an admission of fault or otherwise materially and adversely affects the protected party without the prior written consent of the protected party. 12.4. ***Exclusions.*** Subtotal’s obligations as an indemnifying party will not apply to any claims that result from: (a) unauthorized uses or modifications of the Services; (b) uses or modifications that were made in accordance with Customer’s instructions; (c) use of the Services in combination with products, processes, or materials not provided by Subtotal; (d) use of an old version of the Services where use of a newer version would have avoided the Claim; or (e) Customer continuing to engage in allegedly infringing activity after being notified thereof. ## 13. Limitation of Liability 13.1. ***Non-Direct Damages.*** EXCEPT FOR THE PARTIES’ INDEMNIFICATION OBLIGATIONS AND FOR CUSTOMER’S BREACH OF SECTION 2 (SERVICES) OR ITS OBLIGATIONS WITH RESPECT TO END USER DATA, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL EITHER PARTY BE LIABLE FOR LOST PROFITS OR SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT (WHETHER FROM BREACH OF CONTRACT, BREACH OF WARRANTY, OR FROM NEGLIGENCE, STRICT LIABILITY, OR ANY OTHER FORM OF ACTION), EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY HEREIN. 13.2. ***Aggregate Liability.*** EXCEPT FOR THE PARTIES’ INDEMNIFICATION OBLIGATIONS AND FOR CUSTOMER’S BREACH OF SECTION 2 (SERVICES) OR ITS OBLIGATIONS WITH RESPECT TO END USER DATA, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL EITHER PARTY’S AGGREGATE, CUMULATIVE LIABILITY EXCEED THE AMOUNT PAID OR PAYABLE TO SUBTOTAL BY CUSTOMER DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE RELEVANT CLAIM EXCEPT THAT SUBTOTAL’S TOTAL LIABILITY FOR ANY SERVICES PROVIDED FREE OF CHARGE IS LIMITED TO \$100. 13.3. ***Acknowledgment.*** CUSTOMER ACKNOWLEDGES THAT THE FEES SPECIFIED IN THIS AGREEMENT REFLECT THE ALLOCATION OF RISK SET FORTH IN THIS AGREEMENT AND THAT SUBTOTAL WOULD NOT ENTER INTO THIS AGREEMENT WITHOUT THE FOREGOING LIMITATIONS OF ITS LIABILITY AND THE WARRANTY DISCLAIMERS CONTAINED HEREIN. ## 14. Term and Termination 14.1. ***Term.*** The term of the Agreement (the “**Term**”) shall commence on the Effective Date and shall continue until all Subscription Terms have expired or been terminated. Unless otherwise stated on an Order Form, at the end of the then-current Subscription Term, Customer’s subscription shall automatically renew for an additional term (“**Renewal Term**”), unless either party notifies the other party of non-renewal at least ten (10) calendar days prior to the start of the next Renewal Term. For any Subscription Term of twelve (12) months or longer, Subtotal will provide Customer with reasonable advance notice of the upcoming Renewal Term before it begins. 14.2. ***Termination for Breach or Insolvency.*** In addition to any other remedy available under this Agreement or otherwise, either party may terminate this Agreement (i) in the event the other party commits a material breach of this Agreement and fails to cure such breach within thirty (30) days of written notification thereof from the non-breaching party, and (ii) upon written notice to the other party if the other party should enter into liquidation or become insolvent, or enter into receivership or bankruptcy. 14.3. ***Termination by Customer.*** Customer may terminate this Agreement for convenience by providing written notice to Subtotal within the period of time permitting such termination as specified in the applicable Order Form, if any (such period, the “**Termination Window**”). In the event of such termination, Subtotal will refund any prepaid Fees for Services covering the remainder of the Subscription Term. 14.4. ***Termination by Subtotal.*** Subtotal may terminate this Agreement and Customer's access to the Services upon notice in the event that we determine we are required to do so by law. 14.5. ***Effect of Termination.*** Upon any expiration or termination of this Agreement, except as otherwise provided herein: * Customer’s rights and access to the Services will immediately cease; and * Customer will immediately pay all Fees accrued through the date of termination. If Subtotal terminates the Agreement due to Customer's uncured material breach in accordance with Section 14.2, all Fees for the remainder of the Subscription Term will become immediately due and payable. If Customer terminates under Section 14.3, or if Subtotal terminates under Section 14.4, Subtotal will refund any prepaid, unused Fees for the remainder of the Subscription Term. 14.6. ***Survival.*** Upon any expiration or termination of this Agreement, the rights and obligations of the parties will terminate, except for sections that by their nature and context are intended to survive completion of performance, expiration, termination, or cancellation of this Agreement, including Sections 1, 5, 9-13, 14, and 16. Customer’s liability and obligation to pay any fees or other amounts that have accrued prior to such expiration or termination will also survive such expiration or termination. ## 15. Updates to Agreement Subtotal may modify this Agreement from time to time at our sole discretion. When we do so, we will post the amended Agreement here with a revised “Last Updated” date. You are responsible for reviewing the Agreement regularly to stay informed of any changes. If we make material changes that affect your rights or obligations, we will provide notice by reasonable means, which could include notification through the Services or via email. Any updates to the Agreement will become effective at the start of the next Renewal Term (if any), and will not affect the then-current Subscription Term. ## 16. Miscellaneous 16.1. ***Notification Procedures.*** We may give notice by any means of communication reasonably anticipated to notify you of the information provided. You agree that all notices, disclosures, and other communications that we provide to you electronically satisfy any legal requirement that such communications be in writing or be delivered in a particular manner. You agree that you have the ability to store such electronic communications such that they remain accessible to you in an unchanged form. By way of example only, such communication may be a general notice on the Services or via email to the email address listed on your Customer Account. It is your obligation to update your Customer Account information so that we may contact you as may be necessary. Such notice shall be deemed to have been given 24 hours after dispatch. If physical notice (e.g., US Mail) is used, then such notice shall be deemed to have been given five (5) days after dispatch. 16.2. ***Entire Agreement.*** This Agreement, together with all applicable Order Forms, our [Customer Privacy Policy](https://www.subtotal.com/legal/customers/privacy-policy) and [Data Protection Addendum](https://www.subtotal.com/legal/customers/data-protection-addendum), constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior or contemporaneous statements (whether in writing or not) about its subject matter. In the event of a conflict or inconsistency between the terms of this Agreement and any Order Form, the terms of the Agreement will control except where the Order Form expressly states that it is intended to override or supplement the Agreement. 16.3. ***Governing Law and Venue.*** This Agreement (and any interpretations and disputes relating to this Agreement) shall be governed by and construed in accordance with the laws of Delaware, excluding its conflict of law rules. Any dispute relating to this Agreement shall be brought in the state or federal courts located in Delaware, and each party irrevocably submits to the exclusive jurisdiction of such courts. 16.4. ***Assignment.*** Neither party may assign any rights or obligations under this Agreement without the prior written consent of the other party. However, either party may assign this Agreement upon notice if the assigning party undergoes a merger, change of control, reorganization, or sale of all or substantially all its equity, business, or assets to which this Agreement relates. Any attempted but non-permitted assignment is void. This Agreement will be binding upon and inure to the benefit of the parties and their permitted successors and assigns. 16.5. ***Publicity.*** We may identify you as a user of our Services and use your name and logo in our marketing materials. We may also feature you in a case study published on our website, provided that any substantive content about your use of the Services will be subject to your prior review and approval. Upon our request, you will have your official business account follow Subtotal’s official account on X. 16.6. ***Force Majeure.*** Neither party will be liable for a delay of or failure to perform its obligations under this Agreement if caused by a force majeure event. However, this section does not excuse your obligation to pay Fees due in connection with this Agreement. 16.7. ***Severability and Waiver.*** If any term of this Agreement is found to be invalid or unenforceable by a court or other governing body, the remaining terms of this Agreement will remain in full force and effect. The failure of a party to enforce a term or to exercise any right in this Agreement will not constitute a waiver by that party of the term or right. ## 17. Contact Us For any questions, please contact us at [legal@subtotal.com](mailto:legal@subtotal.com). # End User Privacy Policy Source: https://legal.subtotal.com/legal/end-users/privacy-policy We at Subtotal, Inc. (together with our affiliates, “**Subtotal**,” “**we**,” “**our**,” or “**us**”) take your privacy seriously. This Privacy Policy sets forth our policies and practices with respect to identifiable data that we collect from or about you (“**Personal Data**”) when you use our website, online tools, applications, and services (collectively, “**Services**”)—for example, when you use Subtotal to connect with and provide your information to the apps and websites you use. These apps and websites are owned and maintained by our business customers, including, but not limited to, consumer packaged goods brands whose products are sold in retail (“**Customers**”). By using or accessing our Services, you agree to the practices and policies outlined below, and to our collection, use, and disclosure of your Personal Data as set forth in this Policy. Remember that your use of the Services is also at all times subject to our [End User Terms of Service](https://subtotal.com/legal/end-users/terms-of-service), which incorporate this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service. By entering into and agreeing to our Terms of Service and this Privacy Policy, you acknowledge that Subtotal is the “data controller” or “business” of your Personal Data collected through the Services. ## What this Privacy Policy Covers This Policy describes the data we collect when you access or use our Services and explains how we use and disclose that information. This Policy does not cover the policies or practices of companies we don’t own or control or people we don’t manage, such as Customers. Once your Personal Data has been disclosed to a Customer to which you choose to connect through the Services, the Customer—not Subtotal—is responsible for any further use, processing, or disclosure of that data, including by the Customer’s service providers or any other third parties that receive your data from or through the Customer. You should review the privacy policies and terms of service for those Customers’ apps and websites for information about their practices. This Policy also does not apply to personal information we collect from and about Customers, prospective customers, and visitors to our website, which is governed by our [Customer Privacy Policy](https://www.subtotal.com/legal/customers/privacy-policy). ## Collection, Use, and Disclosure of Personal Data ### Personal Data We Collect We collect your Personal Data from the following sources: * Data you provide directly to us when you use the Services; * Data from businesses you use, transact with, or purchase or order from, including retailers, marketplaces, shopping providers and platforms, and delivery services (“**Retailers**”), when you connect your Retailer accounts through the Services, subject to any applicable privacy settings you have selected; * Data from the device you use to connect your Retailer accounts or otherwise use the Services; * Data from Customers whose apps and websites you have connected your Retailer accounts to, as well as any applicable service providers of Customers where Customers have implemented integrations with such service providers to assist in providing services on their behalf; and * Data from other sources, including our partners, service providers, and identity verification and fraud prevention services. ***Personal Data You Provide***: When you use our Services (for example, when you use Subtotal to connect a Retailer account to a Customer app or website), we collect the following Personal Data: * Identifiers such as your name, address, email address, phone number, and information included in any profiles you maintain with a Retailer (which could include demographic information, your date of birth, your shopping interests, etc.); * Information related to your communications with us—for example, when you communicate with us via email or our social media pages—such as your name, contact information, and the contents of your communications; * Information related to your use of our Services, including which Retailers and Customers you connect using our Services; and * Other information that you may provide to us—for example, when you provide information in free-form text boxes in connection with our Services, participate in our events, or respond to our surveys or questionnaires. ***Personal Data from Retailers***: If you use our Services to connect a Retailer account to a Customer app or website, we collect the following Personal Data from the Retailer: * Identifiers and data about the account owner(s), including name, address, email address, phone number, and information from any profile you maintain with the Retailer (which could include demographic information, your date of birth, your shopping interests, etc.); and/or * Data about your commercial transactions, purchases, and orders with the Retailer, whether made before or after you connect your account, including but not limited to amount paid, all items purchased (even those not associated with a Customer’s brand), purchase date, payment method, device used, and store location, in accordance with any applicable privacy settings you have configured. ***Personal Data Collected Automatically when You Use the Services***: When you visit, use, or interact with the Services, we automatically collect the following information about your visit, use, or interaction: * Log Data: We collect information that your browser or device automatically sends when you use our Services. Log data includes your internet protocol (“**IP**”) address, browser type and settings, the date and time of your request, and how you interact with our Services. * Usage Data: We collect information about your use of our Services, including which Retailer accounts and Customer apps and websites you connect using Subtotal. * Device Information: When you use a device to interact with our Services, we collect information about that device, such as the name of the device, hardware model and operating system, IP address, domain server, the date and time of your interaction with the Services, timezone setting and location, and other technical information about the device. The information we collect may depend on the type of device you use and its settings. * Location Information: We may determine the general area from which your device accesses our Services based on information such as its IP address. * Cookies and Similar Technologies: As described more fully in our [Cookie Policy](https://www.subtotal.com/legal/general/cookie-policy), we use cookies and other related technologies in operating our Services⁠. ***Personal Data from Customers***: If you use Subtotal to connect a Retailer account to a Customer app or website, we may collect identifiers and commercial information about you, including your name, system-specific identifiers (such as a customer ID), address, email address, phone number, and information about your commercial transactions. ***Personal Data from Other Sources***: We receive Personal Data and other information from our partners, including service providers, analytics providers, advertising partners, and security partners—for example, to help us provide you with customer support, to generate leads, and to prevent fraud, abuse, and security threats. ***Information Derived from Personal Data***: We may derive additional information about you from the Personal Data we collect. For example, we may infer your general location from your IP address or your purchasing patterns from your commercial transactions. ***De-Identified Data***: We may de-identify information we collect so the information is no longer Personal Data in that it can no longer reasonably identify you or your device, or we may collect information that is already in de-identified form. Our use and disclosure of de-identified information is not subject to any restrictions under this Privacy Policy, and we may use and disclose it to others for any purpose, without limitation. ### How We Use Your Personal Data We use your Personal Data for the following business and commercial purposes: ***Providing, Operating, and Improving the Services***: To operate, provide, improve, modify, and further develop our Services, including: * Connecting to and accessing your Retailer accounts on your behalf; * Connecting your Retailer accounts with the Customer apps and websites you use; * Creating and managing your account and profile on our system; * Providing you with the products, services, and information you request; * Providing support and assistance for the Services, including to both you and our Customers (including to help facilitate our Customers’ use of integrations within the Services, which may involve disclosing your information to such integrations at a Customer’s request); * Improving the Services, including through testing, research, internal analytics, and product development; * Personalizing the Services and our website content and communications based on your preferences; and * Carrying out other business purposes stated when collecting your Personal Data or as otherwise permitted under applicable data privacy laws. ***Marketing the Services***: To market and sell the Services—for example, and in accordance with applicable laws, by sending marketing emails related to the Services. ***Preventing Fraud***: To investigate and help protect you, Customers, Subtotal, and others from fraud, malicious activity, and other privacy and security-related concerns, including by validating your identity and preventing fraud on your account. ***Developing Insights***: To develop insights based on the Personal Data we’ve collected. This includes but is not limited to your transaction data, data about which Retailer accounts you have connected to which Customer apps and websites, and data from other sources, including Customers and other third parties. ***Communicating with You***: To communicate with you—for example, to respond to emails and other communications we receive from you and to send you legal notices, system updates, and other information about Subtotal or the Services. Please note that our written and verbal communications with you may be recorded, transcribed, and stored by us and vendors on our behalf for training and internal business purposes. ***For Legal Purposes***: To meet legal obligations and protect legal rights under applicable law, including: * Detecting and preventing potential security incidents and other unlawful or prohibited activities; * Investigating any misuse of our Services or Customer apps and websites; * Protecting the rights, property, and safety of you, Subtotal, and other parties; * Enforcing any agreements with you; and * Establishing and defending against claims. ### Online Analytics and Advertising ***Online Analytics.*** As discussed in greater detail in our Cookie Policy, we may use third-party analytics in connection with our Services (e.g., analytics platforms such as Google Analytics or PostHog). These vendors may set and access their own cookies, pixel tags, and similar technologies on our Services and on third-party services to collect information that can be used to track users over time and across services. These analytics tools help us understand how users arrive at and use our Services. If you do not want Google Analytics to collect and use information about your use of our Services, then you can [install an opt-out](https://tools.google.com/dlpage/gaoptout) in your web browser. You also may opt-out from Google Analytics for Display Advertising or the Google Display Network by using Google’s [ads settings](https://www.google.com/settings/ads). ***Online Advertising.*** We strive to provide you with relevant, value-added content in our online advertisements. We work with online analytics and advertising partners to: (i) better understand the use of our Services so that we can improve them; and (ii) deliver advertisements that are more tailored to you both on our Services and on third-party apps and websites. Our partners may place cookies, pixel tags, and similar technologies on many online services, including ours. They use these technologies to collect information about your activities on these services in order to deliver you more relevant advertising. For example, they may use the information they collect from their cookies on our Services to identify products and services you might be interested in. For information about how to opt out of receiving personalized online advertisements from our advertising partners, follow the instructions in the “Your Rights and Choices” section below. Please visit our [Cookie Policy](https://www.subtotal.com/legal/general/cookie-policy) for more details. ### How We Disclose Your Personal Data We disclose your Personal Data as follows: * With service providers, agents, and contractors that help us provide the Services and perform business functions for us or Customers—for example, hosting and storage providers, analytics and communication providers, and customer support providers; * With Customers and Retailers, in relation to the connections you’ve chosen to make between your Retailer accounts and the Customer apps and websites you use. This includes the identifiers and account information described above, such as your name, email address, phone number, and postal code, which we may share even if we have no purchase data associated with your connection, and the purchase and transaction data described above, comprising purchases made both before and after you connect your account and all items purchased (even those not associated with a Customer’s brand); * With service providers, agents, contractors, and partners of Customers as directed by Customers, including through integrations within the Services, where these entities perform services on behalf of Customers (each Customer is solely responsible for any further use or disclosure of your Personal Data to and by such entities or any other third parties that receive your data from or through the Customer); * With advertisers and other third parties who use cookies and related technologies to collect information about your use of the Services and use that information to serve online ads that they think will interest you (please see our Cookie Policy for more details); * To comply with our legal obligations and with legal or regulatory processes (such as subpoenas); * To prevent fraud, malicious activity, and other privacy and security-related concerns or otherwise protect the rights, property, and safety of you, Customers, Retailers, Subtotal, and others; * With third parties in relation to a change in ownership or control of all or a part of our business or assets, or in contemplation thereof, such as a merger, acquisition, bankruptcy, or reorganization; and/or * Between and among Subtotal and our current and future parents, affiliates, and subsidiaries. We may also disclose aggregated, de-identified, or anonymized data for any purpose permitted by law. ## Data Security We seek to protect your Personal Data from unauthorized access, use, and disclosure. We maintain a variety of physical, technical, and administrative security measures appropriate to the risk associated with the processing of your Personal Data. Unfortunately, no data transmission or storage system is completely secure. For additional information about our security practices, please visit our [Security Page](https://security.subtotal.com/). ## Data Retention We retain Personal Data for as long as necessary to provide our Services and to fulfill the purposes for which we collected the data, including for the purposes of complying with our legal obligations, resolving disputes, and collecting fees. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the data, our reason for collecting the data, and the amount and sensitivity of the data. Once the applicable retention period has come to an end, we will take commercially reasonable steps to destroy, overwrite, de-identify, aggregate, or anonymize your Personal Data so that it can no longer be reasonably linked to you. If we aggregate, de-identify, or anonymize data such that it can no longer be used to identify you personally, we may use that information indefinitely without further notice to you. ## Information for International Users We and our processors operate in the United States and may transfer, store, and/or process your information in the United States for the purposes described in this Privacy Policy. Please note that the data protection laws in the United States may be different from those in your jurisdiction of residence (e.g., Canada). Wherever your information is transferred, stored, or processed by us or our processors, we take reasonable steps to protect your information in accordance with this Privacy Policy and applicable laws. These measures may include implementing model clauses to govern the transfer of your information, or other means recognized by applicable laws. By providing us with your information, you acknowledge any such transfer, storage, or processing. If you have any concerns or complaints about our data processing activities, we urge you to first try to resolve such issues directly with us by contacting us using the information below. However, if applicable, you may make a complaint to the data protection supervisory authority in the country where you are based (e.g., the Commission d’accès à l’information (CAI) in Quebec), or seek a remedy through local courts if you believe your rights have been breached. ## Your Rights and Choices ***Your Rights*** No matter where you live, we recognize, and you may exercise, the following rights with respect to your Personal Data, subject to applicable exceptions provided by law: * *Information*. To request information about the categories of Personal Data we have collected, the sources from which we collected the data, and how we have used and disclosed your Personal Data; this information is contained in this Privacy Policy. * *Access*. To access a copy of the Personal Data we have collected from and about you in a structured, commonly used technological format. * *Correction*. To request that inaccurate information about you be corrected. * *Portability*. To have your Personal Data transferred to a third party, where technically feasible. * *Deletion/de-indexing*. To request that we delete/de-index the Personal Data we have collected from and about you. * *Opt Out*. To request to opt out of: * The “sale” of your Personal Data; * The “sharing” or “processing” of your Personal Data for online targeted advertising purposes; * The use of automated decision-making regarding your Personal Data, where such processing results in legal or similarly significant impacts (note that we have not engaged in such processing over the prior 12 months); and * The use of your “sensitive” Personal Data, in certain circumstances (note that we do not process “sensitive” Personal Data in a way that is subject to this opt out right). * *Nondiscrimination and non-retaliation*. To exercise these rights free from discrimination or retaliation. * *Withdrawal of consent.* If the basis on which we are processing your Personal Data is consent, you have the ability to withdraw such consent. Oregon, Connecticut, and Minnesota residents can also request a list of the specific third parties, other than natural persons, to which we have disclosed personal information, and Maryland and Delaware residents can request the categories of such third parties. In addition, you may revoke the account connections you have established through the Services at any time. Please note that we do not collect, use, or sell Personal Data for the purpose of training large language models. ***Marketing Communications*** In accordance with applicable law, we may send you marketing communications. You may opt out of receiving marketing emails from Subtotal by following the instructions in those emails. Even if you opt out of marketing emails, we may still send you other types of messages, such as legal notices and support, service, and other emails regarding your account. ***Exercising Your Rights*** You can exercise the rights described in this section by submitting a request to [**privacy@subtotal.com**](mailto:privacy@subtotal.com)⁠. You may be required to provide additional information to confirm your identity before we can respond to your request. If an authorized agent submits a request on your behalf, we may ask for a valid power of attorney to verify that the agent has written authority to submit requests on your behalf. In certain cases, we may be required or permitted by law to deny your request. To opt out of our use of cookies and pixels in ways that could be considered “sales” or “processing” for “online targeted advertising,” please refer to the “Online Advertising and Analytics” section above. If we deny your request in whole or in part, you also have the right to appeal our denial. You can exercise this right by emailing us at [privacy@subtotal.com](mailto:privacy@subtotal.com) or contacting us as provided below. Your description must include your full name and the email address you used in connection with our Services, along with a copy of the denial notice you received from us. ## Changes to this Privacy Policy We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page and provide additional notice as may be appropriate or required by law—for example, by sending you an email. If you use the Services after any changes to this Policy have been posted, that means you consent to the changes, subject to any applicable legal requirements. ## Personal Data of Children We do not knowingly collect or solicit Personal Data from children under 16 years of age. If you are a child under the age of 16, please do not register for or otherwise use the Services or send us any Personal Data. If we learn that we have collected any Personal Data from a child under 16 years of age, we will take steps to delete that information. If you believe that a child under 16 years of age has provided us with Personal Data, please contact us at [privacy@subtotal.com](mailto:privacy@subtotal.com). ## Additional Information for California Residents If you are a California resident, we agree, in response to your request, to provide you with information about: * The purpose for which we use each category of “personal information” (as defined in the CCPA) we collect; and * The categories of third parties to which we (i) disclose such personal information for a business purpose, (ii) “share” personal information for “cross-context behavioral advertising,” and (iii) “sell” such personal information. Under the CCPA, “sharing” is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across distinct online services, and “selling” is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. We “share” information with our advertising partners to provide more relevant and tailored advertising to you regarding our Services. Moreover, our use of third-party analytics services and online advertising services may result in the sharing of online identifiers (e.g., cookie data, IP addresses, device identifiers, and usage information) in a way that may be considered a “sale” under the CCPA. In the past 12 months, we have processed the categories of personal information listed in the table below. For each category, the table provides the source, business purpose, and general categories of third parties to whom the information may be disclosed. For more detailed information, please see the “Collection, Use, and Disclosure of Personal Data” section above. | Personal Information Category | Business Purpose of Use | Third Parties to Whom Information is Disclosed | Third Parties to Whom Information is Sold/Shared | | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | Identifiers |
  • Provide the Services
  • Personalize the Services
  • Respond to your requests for information
  • Advertising and marketing
  • Analyze and improve the Services
  • For security and legal purposes
|
  • Affiliates
  • Vendors
  • Entities for Legal Purposes
  • Advertising and Analytics Vendors/Partners
  • Customers
  • Retailers
|
  • Advertising and Analytics Vendors/Partners
| | Commercial information (e.g., products or services purchased or considered) |
  • Provide the Services
  • Personalize the Services
  • Respond to your requests for information
  • Advertising and marketing
  • Analyze and improve the Services
  • For security and legal purposes
|
  • Affiliates
  • Vendors
  • Entities for Legal Purposes
  • Advertising and Analytics Vendors/Partners
  • Customers
  • Retailers
|
  • Advertising and Analytics Vendors/Partners
| | Internet or other similar network activity (including usage information) |
  • Provide the Services
  • Personalize the Services
  • Respond to your requests for information
  • Advertising and marketing
  • Analyze and improve the Services
  • For security and legal purposes
|
  • Affiliates
  • Vendors
  • Entities for Legal Purposes
  • Advertising and Analytics Vendors/Partners
  • Customers
  • Retailers
|
  • Advertising and Analytics Vendors/Partners
| | Geolocation data (e.g., physical location at the city/state level) |
  • Provide the Services
  • Personalize the Services
  • Respond to your requests for information
  • Advertising and marketing
  • Analyze and improve the Services
  • For security and legal purposes
|
  • Affiliates
  • Vendors
  • Entities for Legal Purposes
  • Advertising and Analytics Vendors/Partners
  • Customers
  • Retailers
|
  • Advertising and Analytics Vendors/Partners
| | Inferences drawn from other information |
  • Provide the Services
  • Personalize the Services
  • Advertising and marketing
  • Analyze and improve the Services
|
  • Affiliates
  • Vendors
  • Advertising and Analytics Vendors/Partners
  • Customers
  • Retailers
|
  • Advertising and Analytics Vendors/Partners
| | Sensory data (e.g., photos or videos you provide in reviews, customer service call recordings for quality assurance) |
  • Provide the Services
  • Personalize the Services
  • Respond to your requests for information
  • Analyze and improve the Services
|
  • Vendors
  • Entities for Legal Purposes
|
  • Not sold/shared
| | Account log-in credentials |
  • Provide the Services
  • For security and legal purposes
|
  • Vendors
  • Entities for Legal Purposes
|
  • Not sold/shared
| ***Your Choices Regarding “Sharing” and “Selling.”*** You have the right to opt out of the sale or sharing of your personal information for online analytics and advertising purposes. You can exercise this right by contacting us as described in the “Your Rights and Choices” section above. We also honor browser-based opt out signals, such as the global privacy control, in accordance with our legal obligations. ***Other CCPA Rights.*** For information about the additional rights you have under California law and how to exercise them, please see the “Your Rights and Choices” section above. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate disclosures at that time. The CCPA also gives California residents the right to limit the use and disclosure of their “sensitive personal information” (as defined in the CCPA) if such information is used for certain purposes. However, we do not use or disclose sensitive personal information for purposes that would trigger this right to limit. ***Retention of Your Personal Information.*** Please see the “Data Security” and “Data Retention” sections above. ***Do Not Track.*** Do Not Track (“**DNT**”) is a privacy preference that users can enable in certain web browsers. While we are committed to providing meaningful choices about the information collected on our Services for third-party purposes—including through the opt-out mechanisms described above—we do not currently recognize or respond to browser-based DNT signals. Learn more about DNT at [https://www.allaboutdnt.com](https://www.allaboutdnt.com/). ***California “Shine the Light” Disclosure.*** Under California Civil Code Sections 1798.83-1798.84, California residents have the right, in certain circumstances, to request that we do not disclose certain categories of personal information to third parties for their direct marketing purposes, or alternatively, that we maintain a policy to provide a cost-free means of opting out of such disclosures. We maintain such an opt out policy. To make an opt out request, please contact us using the contact information below and include “California Shine the Light Request” in the email subject line. ## Contact Us If you have any questions or comments about this Privacy Policy, our collection and use of your Personal Data, or your rights and choices regarding such collection and use, please contact us at: [**https://www.subtotal.com/**](https://www.subtotal.com/)\ [privacy@subtotal.com](mailto:privacy@subtotal.com)\ 100 Church Street, Suite 800\ New York, NY 10007 We have also appointed Workstreet to act as Subtotal's representative in the European Union for data protection matters, in accordance with Article 27 of the General Data Protection Regulation. If you are in the European Economic Area, Workstreet should be contacted in addition to [privacy@subtotal.com](mailto:privacy@subtotal.com) on matters related to the processing of personal data, including Data Subject Requests. To submit an inquiry, please contact: [ria@workstreet.com](mailto:ria@workstreet.com). # End User Terms of Service Source: https://legal.subtotal.com/legal/end-users/terms-of-service Welcome to Subtotal! Through our Subtotal Link Service, we allow you and other end users (“**Users**”) to connect the accounts you have with retailers, marketplaces, shopping providers and platforms, and delivery services (“**Retailers**”) with Subtotal customers, which include the apps and websites you use, such as those of consumer packaged goods brands whose products are sold in retail (“**Customers**”). As further discussed below, this allows Customers (and Customers’ authorized service providers) to access your purchase history and other information about you as described in our [End User Privacy Policy](https://www.subtotal.com/legal/end-users/privacy-policy), the terms of which are incorporated herein by reference. These Terms of Service (“**Terms**”) form a legally binding agreement between you and Subtotal, Inc. (together with our affiliates, “**Subtotal**,” “**we**,” “**our**,” or “**us**”) concerning your access to and use of our website, online tools, applications, and services (collectively, the “**Services**”). Please read these Terms carefully. They include important information relating to your use of the Services, including **limitations of liability, a class action waiver, and provisions for resolving disputes through arbitration on a mandatory basis unless you opt out**. You agree that by accessing the Services, you have read, understood, and agreed to be bound by these Terms. IF YOU DO NOT AGREE WITH ALL OF THESE TERMS, THEN YOU ARE EXPRESSLY PROHIBITED FROM USING THE SERVICES AND YOU MUST DISCONTINUE USE IMMEDIATELY. These terms do not apply to the Services we provide to our Customers. Those Services are governed by our [**Services Agreement**](https://www.subtotal.com/legal/customers/services-agreement). Except for the Section entitled “**Mandatory Arbitration and Class Action Waiver**” below, which provides for binding arbitration and waiver of class action rights, we reserve the right to revise these Terms, at our sole discretion, at any time. It is your responsibility to check these Terms periodically for changes. Your continued use of the Services after any such update constitutes your binding acceptance of such changes, except where applicable law requires additional notice regarding such updates, in which case we will comply with such requirements. ## Account Registration In order to use certain parts of the Services, you may be required to register for an account (“**User Account**”) on behalf of yourself and/or on behalf of any entity, organization, or individual for which you are registering. You are responsible for ensuring that all required registration information you submit is truthful and accurate, and that your contact information (including email address and phone number) is current. You are solely responsible for maintaining the confidentiality and security of your User Account login information. You agree not to share your login credentials or access to your User Account with anybody or to create more than one account. We are not liable for any losses incurred by you or any party as a result of the unauthorized use of your User Account. You agree to notify us immediately of any known or suspected unauthorized use. ## Linking Retail Accounts Through our Subtotal Link Service, you will be able to link certain of your existing accounts with Retailers so that Subtotal can receive information about your Retailer account and the purchases you make with such Retailers, in accordance with any applicable privacy settings or choices you may make. Subtotal will disclose such account and purchase information to Customers and their authorized service providers for purposes of those Customers providing you with personalized experiences such as rewards, promotions, rebates, online advertising, and offers. Once your information has been disclosed or made available to a Customer, the Customer—not Subtotal—is responsible for any further use, processing, or disclosure of that information by the Customer or any third parties that receive your information from or through the Customer. Subtotal will not retain or store your Retailer account credentials. In linking your Retailer accounts, you represent and warrant that you are the true owner of such accounts and that you have all rights to, and grant us consent to access, such Retailer accounts for purposes of providing the Services. Subtotal will continue to access your linked Retailer account and your past and future purchases from that Retailer until you disable Subtotal’s access. You can disable access to your Retailer accounts at any time by emailing us at [legal@subtotal.com](mailto:legal@subtotal.com). ## Eligibility You may only use the Services if you can form a binding contract with Subtotal (either on behalf of yourself or the entity you represent), and only in compliance with these Terms and all applicable local, state, national, and international laws, rules, and regulations. You must be at least 18 to use the Services. You cannot access or use the Services if you (or your User Account) have previously been suspended or removed from Subtotal. ## Intellectual Property ***License Grant in Services.*** Subject to the terms and conditions herein, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Services solely for the permitted personal uses described herein. No licenses or rights are granted to you by implication or otherwise under any intellectual property rights owned or controlled by us or our licensors, except for the licenses and rights expressly granted in these Terms. ***License Grant in User Data.*** You grant Subtotal a worldwide, non-exclusive, royalty-free, fully paid-up, transferable, and sublicensable license to use any data you provide, upload, or submit through the Services, or that is otherwise collected through your use of the Services (collectively, “**User Data**”), in order for us to provide the Services to our Customers and for other purposes consistent with our [End User Privacy Policy](https://www.subtotal.com/legal/end-users/privacy-policy). This license includes the right to sublicense your User Data to our Customers for the uses described in our [End User Privacy Policy](https://www.subtotal.com/legal/end-users/privacy-policy). ***Reservation of Rights.*** As between you and Subtotal, the Services, including without limitation any content, data, organization, graphics, design, compilation, magnetic translation, sound, artwork, computer code, digital conversion, logos, names, patents, trademarks, service marks, product and service names, slogans, copyrights, and all the intellectual property rights therein or relating thereto, are and shall remain the exclusive property of Subtotal, its Customers, or its licensors (as applicable). Nothing in these Terms shall be interpreted to provide you with any rights in the foregoing, except the limited right to use the Services as expressly set forth herein. ***Feedback.*** From time to time, you may provide us with comments, suggestions, or ideas for enhancements, improvements, changes, or additions to the Services or our business in general, including ideas for new features, materials, and other content (“**Feedback**”). By providing us Feedback, you grant us exclusive ownership of the Feedback and of all intellectual property rights and other rights in it, and you will provide us with reasonable cooperation in documenting this grant. Subtotal has no obligation to do anything with Feedback, but we will have the full, worldwide, unencumbered right to use, incorporate, and otherwise fully exercise and exploit any such Feedback via all forms of media, distribution methods, and technology now known or later developed, for any purposes, commercial or otherwise, and to transfer or license our rights in the Feedback, without notice, acknowledgement, or compensation to you. ## Prohibited Uses In using the Services, you agree that you shall not, and shall not encourage, assist, or enable any third party to: * reproduce, duplicate, modify, copy, adapt, distribute, transmit, display, sell, rent, lease, loan, transfer, publish, create derivative works from or otherwise exploit for any purpose the content, software, products, services, or data found in or on the Services; * alter or tamper with any materials on or associated with the Services; * engage in any activity that could cause us to violate any applicable law, statute, ordinance, or regulation; * engage in any conduct that is fraudulent, inaccurate, infringing, libelous, defamatory, abusive, offensive, obscene, or otherwise violates any law or right of Subtotal, its Users, or any third party, including privacy rights, copyrights, or other intellectual property rights; * submit, send, post, upload, or otherwise make available unsolicited or unauthorized advertising or commercial communications, such as spam, advertising, promotional materials, junk mail, chain letters, or any other form of solicitation; * attempt to circumvent any technological measure implemented by us or any of our providers or any other third party (including another User) to protect or restrict access to the Services; * attempt to decipher, remove, decompile, disassemble, or reverse engineer any software or other underlying code in the Services, or use any network monitoring or discovery software to determine the Services architecture; * remove or modify any copyright, trademark, or other proprietary rights notice that appears on any portion of the Services, or on any materials printed or copied from the Services; * access, download, copy, or collect substantial quantities of data from the Services, whether by automated means (such as bots, spiders, or scrapers) or by manual means (including, without limitation, through repeated individual search queries, copying, or other manual efforts), for the purpose of, or with the effect of, aggregating, compiling, or creating a database or dataset derived from the Services, or in any other manner deemed by Subtotal, in its sole discretion, to be excessive, to exceed normal personal use, or to otherwise constitute prohibited data access or collection, it being understood that this prohibition applies regardless of the method used; * take action that imposes, or may impose, in the discretion of Subtotal, an unreasonable or disproportionately large load on Subtotal's infrastructure; * collect or harvest, including by means of spidering or use of spyware, any data (including personally identifiable information) from the Services; * resell or make any commercial use of the Services except as authorized hereunder without our prior written consent; * impersonate another person or otherwise misrepresent your affiliation with a person or entity, conduct fraud, hide, or attempt to hide your identity; * disrupt, overwhelm, attack, modify, or interfere with the proper working of the Services, or impede or interfere with others’ use of the Services; * access any content in or on the Services through any technology or means other than those provided or authorized by the Services; * transmit any viruses, malicious code, or other computer instructions or technological means whose purpose is to disrupt, damage, or interfere with the use of computers or related systems; * use any content on the Services in any manner that may infringe any intellectual property right, proprietary right, or property right of Subtotal or any third party; * access the Services to build a similar or competitive website, application, product, or service; or * use the Services in any way except as permitted by these Terms. ## Privacy For information about our data practices, including our collection and use of your information, please see our [End User Privacy Policy](https://www.subtotal.com/legal/end-users/privacy-policy), which applies to your use of the Services and is incorporated by reference into these Terms. ## No Endorsement Except where expressly and unambiguously stated otherwise, Subtotal does not endorse, warrant, or make any representation concerning any Customer or Retailer or their products or services. Customers are required to provide accurate information regarding the rewards or other benefits they may offer in connection with your decision to share your Retailer purchase history with them. Subtotal does not confirm, endorse, or make any representations regarding any Customer, Retailer, or the services they may offer. Subtotal has no obligation to mediate or help resolve disputes between Users and Customers and/or Retailers. ## Warranty Disclaimer THE SERVICES ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. USE OF THE SERVICES IS AT YOUR OWN RISK. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES ARE PROVIDED WITHOUT WARRANTIES AS TO THE RELIABILITY, TIMELINESS, QUALITY, SUITABILITY, AVAILABILITY, ACCURACY, OR COMPLETENESS OF THE SERVICES, AND SUBTOTAL HEREBY DISCLAIMS, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ALL REPRESENTATIONS AND WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, SUBTOTAL, ITS SUBSIDIARIES, ITS AFFILIATES, AND ITS LICENSORS MAKE NO WARRANTIES THAT (i) THE SERVICES WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS; (ii) THE SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE; OR (iii) ANY DEFECTS OR ERRORS WILL BE CORRECTED. SUBTOTAL SPECIFICALLY DISCLAIMS ANY WARRANTY THAT THE SERVICES WILL ENABLE YOU TO OBTAIN ANY SPECIFIC RESULT. PLEASE NOTE THAT SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SOME OF THE ABOVE EXCLUSIONS MAY NOT APPLY TO YOU. YOU MAY ALSO HAVE ADDITIONAL RIGHTS THAT VARY BY JURISDICTION. ## Additional Disclaimers YOU ACKNOWLEDGE AND UNDERSTAND THAT SUBTOTAL DOES NOT MONITOR ANY CUSTOMER’S OR RETAILER’S (OR THEIR SERVICE PROVIDERS’) COMPLIANCE WITH LAWS, AND SUBTOTAL WILL NOT BE RESPONSIBLE FOR ANY LIABILITY, CLAIMS, OR DAMAGES ARISING FROM OR IN ANY WAY RELATED TO SUCH THIRD PARTIES’ CONDUCT. YOU ARE SOLELY RESPONSIBLE FOR ALL COMMUNICATIONS AND INTERACTIONS WITH CUSTOMERS, OTHER USERS OF SUBTOTAL, AND ANY OTHER PERSONS YOU COMMUNICATE OR INTERACT WITH AS A RESULT OF YOUR USE OF THE SERVICES. YOU AGREE TO TAKE REASONABLE PRECAUTIONS IN ALL SUCH COMMUNICATIONS AND INTERACTIONS. SUBTOTAL EXPLICITLY DISCLAIMS ALL LIABILITY FOR THE ACTS OR OMISSIONS OF ANY CUSTOMERS. SUBTOTAL MAKES NO REPRESENTATIONS OR WARRANTIES REGARDING THE QUALITY, SAFETY, SUITABILITY, OR LEGALITY (INCLUDING COMPLIANCE WITH APPLICABLE LAWS) OF ANY CUSTOMER OR THEIR PRODUCTS OR SERVICES. YOU UNDERSTAND AND AGREE THAT SUBTOTAL IS NOT RESPONSIBLE FOR THE PERFORMANCE OR CONDUCT, ONLINE OR OFFLINE, OF ANY CUSTOMER. EACH CUSTOMER IS SOLELY RESPONSIBLE FOR ITS OWN USE OF YOUR INFORMATION AND FOR ANY FURTHER USE, PROCESSING, OR DISCLOSURE OF YOUR INFORMATION BY THE CUSTOMER'S SERVICE PROVIDERS OR ANY OTHER THIRD PARTIES THAT RECEIVE YOUR INFORMATION FROM OR THROUGH THE CUSTOMER. ## Indemnification To the fullest extent permitted by law, you agree at your own expense to indemnify, defend, and hold harmless Subtotal, and its subsidiaries, agents, licensors, managers, and other affiliated companies, and each of their employees, contractors, agents, officers, and directors (collectively, the “**Subtotal Entities**”), from and against any and all claims, demands, actions, suits, damages, obligations, losses, liabilities, judgments, costs or debt, and expenses (including but not limited to attorneys’ fees) incurred in, arising out of, or in any way related to: (i) your breach or alleged breach of these Terms; (ii) your use of or access to the Services (or another User’s use of your User Account); (iii) content you submit, post, or transmit through the Services; (iv) any dispute between you and any third party (including without limitation any Customer); (v) your violation of any applicable law, rule, or regulation; and (vi) your negligence or willful misconduct. These indemnification obligations shall survive the termination of these Terms and your use of the Services. We reserve the right, at our own expense, to assume the exclusive defense and control of any such dispute. You agree to cooperate fully with us in asserting any available defenses. You will not settle, compromise, or otherwise resolve any such claim without our prior written consent. ## Limitations of Liability TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE SUBTOTAL ENTITIES BE LIABLE TO YOU FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION ANY DAMAGES FOR LOSS OF PROFITS, GOODWILL, BUSINESS INTERRUPTION, OR ANY OTHER INTANGIBLE LOSS, ARISING OUT OF OR RELATING TO YOUR ACCESS TO OR USE OF, OR YOUR INABILITY TO ACCESS OR USE, THE SERVICES OR ANY MATERIALS OR CONTENT ON SUBTOTAL OR ARISING OUT OF OR WITH RESPECT TO ANY SERVICES PROVIDED BY SUBTOTAL, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT ANY SUBTOTAL ENTITY HAS BEEN INFORMED OF THE POSSIBILITY OF DAMAGE. IN NO EVENT WILL THE TOTAL, AGGREGATE LIABILITY OF THE SUBTOTAL ENTITIES, ARISING FROM OR RELATING TO THE TERMS, THE SERVICES, OR FROM THE USE OF OR INABILITY TO USE THE SERVICES, EXCEED THE TOTAL AMOUNT OF FEES ACTUALLY PAID TO SUBTOTAL BY YOU HEREUNDER IN THE SIX (6) MONTH PERIOD WHICH IMMEDIATELY PRECEDES THE EVENT WHICH GIVES RISE TO THE CLAIM OF LIABILITY, OR ONE HUNDRED U.S. DOLLARS IF NO SUCH PAYMENTS HAVE BEEN MADE, AS APPLICABLE. EACH PROVISION OF THESE TERMS THAT PROVIDES FOR A LIMITATION OF LIABILITY, DISCLAIMER, OR EXCLUSION OF DAMAGES IS INTENDED TO AND DOES ALLOCATE THE RISKS BETWEEN THE PARTIES UNDER THESE TERMS. THIS ALLOCATION IS AN ESSENTIAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES. EACH OF THESE PROVISIONS IS SEVERABLE AND INDEPENDENT OF ALL OTHER PROVISIONS OF THESE TERMS. THE LIMITATIONS IN THIS SECTION WILL APPLY EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. SOME JURISDICTIONS DO NOT ALLOW THE DISCLAIMER OR EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES. ACCORDINGLY, SOME OF THE ABOVE LIMITATIONS SET FORTH ABOVE MAY NOT APPLY TO YOU OR BE ENFORCEABLE WITH RESPECT TO YOU. IF YOU ARE DISSATISFIED WITH ANY PORTION OF THE SERVICES OR WITH THESE TERMS, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USE OF THE SERVICES. IF YOU ARE AN INDIVIDUAL USER FROM NEW JERSEY, THE FOREGOING SECTIONS TITLED “WARRANTY DISCLAIMER” AND “LIMITATION OF LIABILITY” ARE INTENDED TO BE ONLY AS BROAD AS IS PERMITTED UNDER THE LAWS OF THE STATE OF NEW JERSEY. IF ANY PORTION OF THESE SECTIONS IS HELD TO BE INVALID UNDER THE LAWS OF THE STATE OF NEW JERSEY, THE INVALIDITY OF SUCH PORTION WILL NOT AFFECT THE VALIDITY OF THE REMAINING PORTIONS OF THE APPLICABLE SECTIONS. ## Modification, Suspension, and Termination Except as prohibited by applicable local legal requirements, we reserve the right to modify or discontinue the Services (or any portion thereof), temporarily or permanently, for any reason whatsoever, with or without notice. YOU AGREE THAT SUBTOTAL SHALL NOT BE LIABLE TO YOU OR TO ANY THIRD PARTY FOR ANY SUCH MODIFICATION, SUSPENSION, OR DISCONTINUANCE OF THE SERVICES OR ANY FEATURES OR PORTIONS THEREOF. We may, in our sole and absolute discretion, terminate, suspend, or otherwise deny your access to all or part of the Services at any time for any or no reason at all, with or without notice to you. If we terminate your right to access the Services, these Terms will terminate and all rights granted to you herein with respect to the Services will immediately terminate. Upon termination of your use of or access to the Services, we will terminate your connections between Customers and Retailers and stop disclosing your purchase data to Customers. You can terminate use of the Services at any time by submitting a request to delete your account to [privacy@subtotal.com](mailto:privacy@subtotal.com). The termination or expiration of these Terms shall not affect those provisions which, by their nature, are intended to survive termination, including but not limited to, provisions relating to confidentiality, intellectual property rights, warranties and disclaimers, limitations of liability, indemnification, dispute resolution, and any accrued rights or obligations. All such provisions shall remain in full force and effect notwithstanding the termination or expiration of these Terms. ## Mandatory Arbitration and Class Action Waiver PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE OR PARTICIPATE IN A LAWSUIT IN COURT. ***Informal Dispute Resolution Procedure*** If a Dispute (as that term is defined below) arises between you and Subtotal, we are committed to working with you to try to reach a reasonable resolution. For any such Dispute, both parties acknowledge and agree that they will first make a good faith effort to resolve it informally before initiating any formal Dispute resolution proceeding in arbitration or otherwise. Such informal resolution requires first sending a written description of the Dispute to the other party. For any Dispute you initiate, you agree to send the written description of the Dispute along with the email address associated with your account, if applicable, to [legal@subtotal.com](mailto:legal@subtotal.com). The written description must be on an individual basis and provide, at minimum, the following information: your name; a detailed description of the nature or basis of the claim or dispute; the specific relief sought; why you believe you are entitled to such relief; and proof of your relationship with Subtotal. You and Subtotal agree, following receipt of the written description, to negotiate in good faith about the Dispute. If the Dispute is not resolved within sixty (60) days after receipt of the properly submitted written description of the Dispute, you and Subtotal agree to the further Dispute resolution provisions below. The parties are strongly encouraged, though not required, to engage in a good faith effort to resolve any Dispute through the aforementioned informal Dispute resolution process, including direct personal involvement by each party, prior to initiating any formal Dispute resolution proceeding. The parties agree that any relevant limitations period and filing fees or other deadlines will be tolled while the parties engage in this informal Dispute resolution process. ***Mutual Arbitration Agreement*** If the informal Dispute resolution procedure does not lead to resolution, then either party may initiate binding arbitration as the sole means to resolve Disputes (except as expressly provided herein), subject to the terms set forth below and the National Arbitration and Mediation (“**NAM**”) rules. If you are initiating arbitration, a copy of the demand shall also be emailed to [legal@subtotal.com](mailto:legal@subtotal.com). If you are a Subtotal registered user, any demand initiating arbitration, whether filed by you or Subtotal, must include the email address you used to register with Subtotal. You agree that by using the Services in any way, you unconditionally consent and agree that any claim, dispute, or controversy (whether in contract, tort, or otherwise) you may have against the Subtotal Entities arising out of, relating to, or connected in any way with Subtotal’s Services or these Terms, including the determination of the scope, enforceability, or applicability of this Arbitration Agreement (as defined below), including, but not limited to, any claim that all or any part thereof of this Arbitration Agreement is void or voidable, whether a claim is subject to arbitration, and any dispute regarding the payment of administrative or arbitrator fees (including the timing of such payments and remedies for nonpayment) (“**Dispute**”) will be resolved exclusively by final and binding arbitration in accordance with this Section (“**Arbitration** **Agreement**”). FOR THE AVOIDANCE OF DOUBT, THE ARBITRATOR, AND NOT ANY FEDERAL, STATE, OR LOCAL COURT OR AGENCY, SHALL HAVE EXCLUSIVE AUTHORITY TO RESOLVE ANY DISPUTE RELATING TO THE INTERPRETATION, APPLICABILITY, ENFORCEABILITY, OR FORMATION OF THIS ARBITRATION AGREEMENT. THIS DELEGATION OF AUTHORITY TO THE ARBITRATOR IS INTENDED TO BE COMPREHENSIVE AND APPLIES EVEN IF A PORTION OF THIS ARBITRATION AGREEMENT IS OTHERWISE FOUND UNENFORCEABLE. This Arbitration Agreement is intended to be interpreted broadly, and it applies to claims that arose, were asserted, or involve facts occurring before the existence of this Arbitration Agreement or any prior agreement as well as claims that may arise after the termination of this Arbitration Agreement, in accordance with the subsection entitled “**30-Day Right to Opt Out**” and the subsection entitled “**Changes**” set forth herein. **If you accept this Arbitration Agreement, then any previous arbitration agreement you had with Subtotal is superseded and any Disputes, regardless of when they arose, will be subject to the provisions of this Arbitration Agreement**. This Arbitration Agreement is made pursuant to a transaction involving interstate commerce, and shall be governed by the Federal Arbitration Act (“**FAA**”), 9 U.S.C. §§ 1-16. Notwithstanding the parties’ decision to resolve all Disputes through arbitration, each party retains the right to (i) elect to have any claims resolved in small claims court on an individual basis for disputes and actions within the scope of such court’s jurisdiction, regardless of what forum the filing party initially chose; (ii) bring an action in state or federal court to protect its intellectual property rights (“intellectual property rights” in this context means patents, copyrights, moral rights, trademarks, and trade secrets and other confidential or proprietary information, but not privacy or publicity rights) or for defamation; and (iii) seek a declaratory judgment, injunction, or other equitable relief in a court of competent jurisdiction regarding whether (a) a complaining party has satisfied the Informal Dispute Resolution Procedure described in the subsection entitled “**Information** **Dispute** **Resolution** **Procedure**” above (including whether the written description contained all required information), (b) a party’s claims are time-barred, or (c) a party’s claims may be brought in small claims court. Seeking such relief shall not waive a party’s right to arbitration under this Arbitration Agreement, and any arbitration related to any action filed pursuant to this paragraph shall automatically be stayed pending the outcome of such action. ***Class Arbitration and Collective Relief Waiver*** YOU AND SUBTOTAL ACKNOWLEDGE AND AGREE THAT, TO THE MAXIMUM EXTENT ALLOWED BY LAW, EXCEPT AS SET OUT OTHERWISE IN THE SUBSECTION ENTITLED “**BATCH** **ARBITRATION**” BELOW, ANY ARBITRATION SHALL BE CONDUCTED IN AN INDIVIDUAL CAPACITY ONLY AND NOT AS A CLASS OR COLLECTIVE ACTION AND THE ARBITRATOR MAY AWARD RELIEF ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO RESOLVE AN INDIVIDUAL PARTY’S CLAIM, UNLESS SUBTOTAL PROVIDES ITS CONSENT TO CONSOLIDATE IN WRITING. ***Arbitration Rules*** The arbitration will be administered by NAM and conducted before a sole arbitrator in accordance with the rules of NAM, including, as applicable, NAM Comprehensive Dispute Resolution Rules and Procedures, Fees For Disputes When One of the Parties is a Consumer, and the Mass Filing Dispute Resolution Rules and Procedures in effect at the time any demand for arbitration is filed with NAM, excluding any rules or procedures governing or permitting class or representative actions. The applicable NAM rules and procedures are available at [www.namadr.com](http://www.namadr.com) or by emailing National Arbitration and Mediation’s Commercial Department at [commercial@namadr.com](mailto:commercial@namadr.com). ***Arbitration Location and Procedure*** For all U.S. residents, the arbitration shall be held (i) at a location determined under the applicable NAM rules and procedures that is reasonably convenient for you and is no more than 100 miles from your home or place of business; or (ii) at another location you and we agree upon. For non-U.S. residents, the arbitration shall be held in New York, NY (unless otherwise agreed by the parties). The arbitrator shall apply Delaware law consistent with the FAA and applicable statutes of limitations, and shall honor claims of privilege recognized at law. The arbitrator or arbitration body shall be empowered to grant whatever relief would be available in a court under law or in equity. The arbitrator has the right to impose sanctions in accordance with the NAM rules and procedures for any frivolous claims or submissions the arbitrator determines have not been filed in good faith, as well as for a party’s failure to comply with the Informal Dispute Resolution Procedure contemplated by this Arbitration Agreement. If the amount in controversy does not exceed \$10,000 and you do not seek injunctive or declaratory relief, then the arbitration will be conducted solely on the basis of documents you and Subtotal submit to the arbitrator, unless the arbitrator determines that a hearing is necessary or the parties agree otherwise. If the amount in controversy exceeds \$10,000 or seeks declaratory or injunctive relief, either party may request (or the arbitrator may determine) to hold a hearing, which shall be via videoconference or telephone conference unless the parties agree otherwise. Subject to the applicable NAM rules and procedures, the parties agree that the arbitrator will have the discretion to allow the filing of dispositive motions if they are likely to efficiently resolve or narrow issues in dispute. Unless otherwise prohibited by law, all arbitration proceedings will be confidential and closed to the public and any parties other than you and Subtotal (and your and Subtotal’s authorized representatives and agents), and all records relating thereto will be permanently sealed, except as necessary to obtain court confirmation of the arbitration award (provided that the party seeking confirmation shall seek to file such records under seal to the extent permitted by law). ***Batch Arbitration*** To increase the efficiency of administration and resolution of arbitrations, in the event 100 or more similar arbitration demands (those asserting the same or substantially similar facts or claims, and seeking the same or substantially similar relief) presented by or with the assistance or coordination of the same law firm(s) or organization(s) are submitted to NAM against Subtotal (“**Mass** **Filing**”), the parties agree (i) to administer the Mass Filing in batches of 100 demands per batch (to the extent there are fewer than 100 arbitration demands left over after the batching described above, a final batch will consist of the remaining demands) with the allowance that multiple batches may be filed, processed, and adjudicated simultaneously, with reasonable administrative staging if necessary for efficient management of such proceedings (ii) to designate one arbitrator for each batch; (iii) to accept applicable fees, including any related fee reduction determined by NAM in its discretion; (iv) that no other demands for arbitration that are part of the Mass Filing may be filed, processed, or adjudicated until the prior batch of 100 is filed, processed, and adjudicated; (v) that fees associated with a demand for arbitration included in a Mass Filing, including fees owed by Subtotal and the claimants, shall only be due after your demand for arbitration is included in a set of batch proceedings and that batch is properly designated for filing, processing, and adjudication; and (vi) that the staged process of batched proceedings, with each set including 100 demands, shall continue until each demand (including your demand) is adjudicated or otherwise resolved. Arbitrator selection for each batch shall be conducted to the greatest extent possible in accordance with the applicable NAM rules and procedures for such selection, and the arbitrator will determine the location where the proceedings will be conducted. You agree to cooperate in good faith with Subtotal and the arbitration provider to implement such a “batch approach” or other similar approach to provide for an efficient resolution of claims, including the payment of combined reduced fees, set by NAM in its discretion, for each batch of claims. The parties further agree to cooperate with each other and the arbitration provider or arbitrator to establish any other processes or procedures that the arbitration provider or arbitrator believe will provide for an efficient resolution of claims. Any disagreement between the parties as to whether this provision applies or as to the process or procedure for batching shall be resolved by a procedural arbitrator appointed by NAM. This “Batch Arbitration” provision shall in no way be interpreted as increasing the number of claims necessary to trigger the applicability of NAM’s Mass Filing Supplemental Dispute Resolution Rules and Procedures or authorizing class arbitration of any kind. Unless Subtotal otherwise consents in writing, Subtotal does not agree or consent to class arbitration, private attorney general arbitration, or arbitration involving joint or consolidated claims under any circumstances, except as set forth in this subsection entitled “**Batch** **Arbitration.**” If your demand for arbitration is included in the Mass Filing, your claims will remain tolled until your demand for arbitration is decided, withdrawn, or settled. The parties agree that this Batch Arbitration provision is integral to the Arbitration Agreement insofar as it applies to a Mass Filing. If the Batch Arbitration provision is found to be invalid, unenforceable, or illegal, then the entirety of this Arbitration Agreement shall be null and void, and neither you nor Subtotal shall be entitled to arbitrate any claim that is a part of the Mass Filing. ***Mediation Following First Batch in a Mass Filing*** The results of the first batch of demands will be given to a NAM mediator selected from an initially proposed group of 5 mediators, with Subtotal and the remaining claimants’ counsel being able to strike one mediator each and then rank the remaining mediators and the highest collectively ranked mediator being selected. The selected mediator will try to facilitate a resolution of the remaining demands in the Mass Filing. After the results are provided to the mediator, Subtotal, the mediator, and the remaining claimants will have 90 days (the “**Mediation** **Period**”) to agree on a resolution or substantive methodology for resolving the outstanding demands. If they are unable to resolve the outstanding demands during the Mediation Period, and cannot agree on a methodology for resolving them through further arbitrations, either Subtotal or any remaining claimant may opt out of the arbitration process and have the demand(s) proceed in court. Notice of the opt-out will be provided in writing within 60 days of the close of the Mediation Period. If neither Subtotal nor the remaining claimants opt out and they cannot agree to a methodology for resolving the remaining demands through further arbitration, the arbitrations will continue with the batching process. Opt out of arbitration under this subsection shall not be construed as opt out of the subsection entitled “**Class** **Action** **Waiver**” below. Absent notice of an opt-out, the arbitrations will proceed in the order determined by the sequential numbers assigned to demands in the Mass Filing. ***Arbitrator’s Decision*** The arbitrator’s decision shall be controlled by the terms and conditions of these Terms and any of the other agreements referenced herein that the applicable user may have entered into in connection with the Services. The arbitrator will render an award within the time frame specified in the applicable NAM rules and procedures. The arbitrator’s decision will include the essential findings and conclusions upon which the arbitrator based the award. Judgment on the arbitration award may be entered in any court having jurisdiction thereof. The arbitrator will have the authority to award monetary damages on an individual basis and to grant, on an individual basis, any non-monetary remedy or relief available to an individual to the extent available under applicable law, the arbitral forum’s rules, and this Arbitration Agreement. The parties agree that the damages and/or other relief must be consistent with the terms of the “Limitation of Liability” section of these Terms as to the types and the amounts of damages or other relief for which a party may be held liable. No individual arbitration award or decision will have any preclusive effect as to issues or claims in any Dispute, except to preclude the same or similar claims from being re-arbitrated between the same parties. Attorneys’ fees will be available to the prevailing party in the arbitration if authorized under applicable substantive law governing the claims in the arbitration. ***Fees*** If you are able to demonstrate that the costs of arbitration will be prohibitive as compared to the costs of litigation, Subtotal will pay any filing and hearing fees in in excess of \$250 that the arbitrator deems necessary to prevent the arbitration from being cost-prohibitive regardless of the outcome of the arbitration, unless the arbitrator determines that your claim(s) were frivolous or asserted in bad faith, in which case arbitration fees (including attorneys’ fees) may be imposed upon you consistent with the Arbitrator’s Rules and the standard for sanctions set forth in Federal Rule of Civil Procedure 11. You are responsible for your own attorneys’ fees unless the arbitration rules and/or applicable law provide otherwise, including as set forth in this Arbitration Agreement. The parties agree that NAM has discretion to reduce the amount or modify the timing of any administrative or arbitration fees due under NAM’s Rules where it deems appropriate (including as specified in the subsection entitled “**Batch Arbitration**”), provided that such modification does not increase the costs to you, and you further agree that you waive any objection to such fee modification. The parties also agree that a good-faith challenge by either party to the fees imposed by NAM does not constitute a default, waiver, or breach of this Arbitration Agreement while such challenge remains pending before NAM, the arbitrator, and/or a court of competent jurisdiction, and that any and all due dates for those fees shall be tolled during the pendency of such challenge. ***Thirty (30)-Day Right to Opt-Out*** You have the right to opt out and not be bound by the Arbitration Agreement by sending written notice of your decision to opt out to [legal@subtotal.com](mailto:legal@subtotal.com) with the subject line, “ARBITRATION OPT-OUT.” The notice must be sent within thirty (30) days of September 8, 2025, or your first use of Subtotal, whichever is later. Otherwise, you shall be bound to arbitrate Disputes in accordance with the terms of these paragraphs. If you opt out of the Arbitration Agreement, Subtotal also will not be bound by it. If you opt-out of a new clause, the prior clause will continue to govern any Disputes between you and Subtotal, unless you had opted out of that clause as well. You agree that, if at some point in the future Subtotal removes this Arbitration Agreement, restoring the right to proceed in court, no opt out from that change is required. Subtotal will continue to honor any valid opt outs if you opted out of arbitration in a prior version of the Agreement pursuant to the requirements set forth in that version. If you do not timely opt out of this Arbitration Agreement, such action shall constitute mutual acceptance of the terms of these “Dispute Resolution” provisions by you and Subtotal. ***Changes*** Subtotal will provide thirty (30) days’ notice of any material changes to this “**Mandatory Arbitration and Class Action Waiver**” Section. Any such changes will go into effect thirty (30) days after Subtotal provides this notice and apply to all claims not yet filed regardless of when such claims may have accrued. If Subtotal changes this “**Mandatory Arbitration and Class Action Waiver**” Section after the date you first accepted this Arbitration Agreement (or accepted any subsequent changes to this Arbitration Agreement), you agree that your continued use of Subtotal thirty (30) days after such change will be deemed acceptance of those changes. ***Severability*** If any part of this this “**Mandatory Arbitration and Class Action Waiver**” Section is found by a court of competent jurisdiction to be unenforceable, the court will reform the agreement to the extent necessary to cure the unenforceable part(s), and the parties will arbitrate their Dispute(s) without reference to or reliance upon the unenforceable part(s). Notwithstanding the foregoing, if for any reason the subsection entitled “**Class** **Action** **Waiver**” set forth below or the subsection entitled “**Batch** **Arbitration**” cannot be enforced as to some or all of the Dispute, then the agreement to arbitrate will not apply to that Dispute or portion thereof. Any Disputes covered by any deemed unenforceable Class Action Waiver provision may only be litigated in a court of competent jurisdiction, but the remainder of the agreement to arbitrate will be binding and enforceable. ***Class Action Waiver*** YOU AND SUBTOTAL AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF, REPRESENTATIVE, OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, MASS, OR REPRESENTATIVE ACTION OR PROCEEDING. FURTHER, EXCEPT AS DESCRIBED IN THE “**BATCH ARBITRATION**” SUBSECTION, NO ARBITRATION SHALL BE JOINED WITH ANY OTHER ARBITRATION, AND THE ARBITRATOR MAY NOT CONSOLIDATE ANY PERSON'S CLAIMS WITH YOUR CLAIMS, AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. Except as described in the subsection entitled “**Batch** **Arbitration,**” class actions, class arbitrations, collective actions, private attorney general actions, and consolidation with other arbitrations aren’t allowed. ## Governing Law For any dispute not subject to arbitration or under the jurisdiction of a small claims court, you and Subtotal agree to submit to the personal and exclusive jurisdiction of any venue in the federal and state courts located in New York, NY. You further agree to accept service of process by mail and hereby waive any and all jurisdictional and venue defenses otherwise available. These Terms and the relationship between you and Subtotal shall be governed by the laws of the State of Delaware without regard to conflict of law provisions. ## Miscellaneous ***Entire Agreement.*** These Terms constitute the entire agreement between you and Subtotal, and supersede any prior and contemporaneous agreements between you and Subtotal on the subject matter. ***Force Majeure.*** Under no circumstances will Subtotal be liable for any delay or failure in performance resulting directly or indirectly from any event beyond its reasonable control. ***Statute of Limitations.*** You agree that regardless of any statute or law to the contrary, any claim or cause of action arising out of or related to the use of the Services, or the Terms, must be filed within one (1) year after such claim or cause of action arose or be forever barred. ***No Waiver.*** No waiver of any term of these Terms shall be deemed a further or continuing waiver of such term or any other term, and Subtotal’s failure to assert any right or provision under these Terms shall not constitute a waiver of such right or provision. ***Severability.*** Each of the provisions of these Terms operates separately. If any provision is found unlawful or unenforceable by a court or other competent authority, the remaining provisions will remain in full force and effect. In such case, you and Subtotal agree that the provision shall be modified or amended by the court or other competent authority to the extent necessary to render it enforceable, while preserving the original intent of the parties as closely as possible and remaining consistent with applicable law. ***Third-party beneficiaries.*** Except as otherwise expressly provided herein, there shall be no third-party beneficiaries to these Terms. ***No agency.*** No agency, partnership, joint venture, or employee-employer relationship is intended or created by these Terms, and you shall have no right or authority to assume or create any obligations or to make any representations on behalf of Subtotal, or to bind Subtotal in any respect. ***Assignment.*** These Terms, and any rights and licenses granted hereunder, may not be transferred or assigned by you without Subtotal’s prior written consent. The Agreement may be assigned by Subtotal without restriction. Any attempted transfer or assignment in violation hereof shall be null and void. ***Electronic processing.*** You agree that any agreements between you and Subtotal executed or accepted in electronic form shall have the same force and effect as agreements executed in physical written form. ***Headings.*** Headings and subheadings in these Terms are for convenience only and have no legal or contractual effect. ## Contact Us If you wish to contact us or have any questions or concerns related to these Terms or your use of the Services, please email us at [legal@subtotal.com](mailto:legal@subtotal.com) or write to us at 100 Church Street, Suite 800, New York, NY 10007. # Cookie Policy Source: https://legal.subtotal.com/legal/general/cookie-policy Subtotal uses cookies, web beacons, and other technologies (collectively, “**Cookies**”) when you use any of our websites, online tools, applications, and services (collectively, the “**Services**”). This Policy explains what Cookies are, why we use them, and how you can manage their use. ## Disabling Cookies If you do not wish to accept the use of Cookies, please disable them by following the instructions set forth in this Policy or by changing your browser settings so that Cookies cannot be placed on your computer or mobile device. Disabling certain Cookies (i.e., essential Cookies) may render our Services inaccessible in whole or in part. ## What Are Cookies? Cookies are text files containing small amounts of information which are automatically downloaded to your computer or device when you visit a website or other online service. Cookies send data back to the originating website on each subsequent visit, or share data with other websites that recognize that cookie. Cookies are useful because they allow a website to recognize a user's device over time. They can be used for varied purposes, such as letting you navigate between pages efficiently, remembering your preferences, personalizing your online experience, and improving the user experience. They can also help to ensure that the advertisements you see online are more relevant to you and your interests. ## How We Use Cookies We use Cookies for a variety of purposes—to remember your preferences, provide product and site functionality, analyze your use of the Services, enhance and personalize your experience, and provide online advertising that is more tailored to your interests. ## Types of Cookies We Use We use the following types of Cookies on the Services: * ***Strictly Necessary Cookies.*** These are Cookies that are required for the operation of our Services (e.g., to enable you to log-in to secure areas of our Services). Without these Cookies, many of the Services cannot be provided. We want you to understand these essential Cookies and why we use them, but we don't need your consent to use them on our Services, as we use them only to provide you with Services that you have requested. You cannot opt out of these Cookies. * ***Functional Cookies.*** These Cookies allow our Services to remember choices you make—such as your username, preferences, and settings (e.g., language choice); whether you have used our Services before; limits on how often certain content is displayed; and your general location. The aim of these Cookies is to provide you with a more personalized experience so that you don't have to reset your preferences each time you use our Services. As described below, you may disable these Cookies; however, doing so may make certain features of our Services unavailable or prevent them from working as intended. * ***Performance Cookies.*** These Cookies collect information about how you use and interact with our Services—for instance, which parts of the Services you use most often—and help us understand overall usage patterns. They also enable us to personalize content and improve the way our Services function, providing you with a better, more tailored experience. * ***Targeting Cookies.*** These Cookies track your visits to and interactions with our Services. We, along with third-party advertising platforms or networks, may use this information to make the content and advertisements you see on our Services and other websites more relevant to your interests (this is sometimes called “targeted” advertising). They are also used to limit how often you see a particular advertisement and to help measure the effectiveness of advertising campaigns. To find out more about interest-based ads and your choices, visit these sites: [**Digital Advertising Alliance**](https://digitaladvertisingalliance.org/), [**Network Advertising Initiative**](https://thenai.org/), and [**Interactive Advertising Bureau (IAB) Europe**](https://iabeurope.eu/). ## How Long Do Cookies Stay on My Device? Some Cookies are active only while you are visiting a website and are automatically deleted once you close your browser; these are called “session” Cookies. Other Cookies remain on your device between browsing sessions and are not deleted when the browser is closed; these are called “persistent” Cookies. The duration of a persistent Cookie varies depending on the specific Cookie. ## Third-Party Cookies Certain third parties, such as advertising networks and providers of external services like web traffic analytics, may also place Cookies on our Services. For example, we use trusted partners such as Google Analytics to help us understand how our Services are used. Google Analytics uses performance Cookies to track visitor interactions, including which pages are visited, which are most popular, the time of visits, whether a visitor has been to our Services before, the website that referred the visitor, and other similar information. We have little control over these “third-party” Cookies, so we suggest that you review the respective privacy policies of these external providers to help you understand what data they collect about you and what they do with it. ## How to Control which Cookies Are Set There are a number of ways you can manage what Cookies are set on your device. Please note, however, that essential Cookies cannot be disabled. In addition, blocking certain Cookies may prevent you from accessing parts of the Services or may cause some features and functions to operate improperly. ## Your Cookie Choices ***All Cookies.*** You can manage your preferences for all types of Cookies through your web browser. Because the steps to activate or deactivate Cookies vary by browser, you should consult your browser’s help menu for more information. You can also configure your browser to notify you when a Cookie is received, allowing you to decide whether to accept it. Cookies do not, under any circumstances, read data from your hard drive, and you can delete them from your device at any time. Please note that it is currently not possible to synchronize your Cookie settings across browsers and devices. You must set them individually on each browser and device you use, and again each time you use a new one. ***Targeting Cookies.*** If you would like more information about tailored online advertising and how to control Cookies used for that purpose, you can visit resources such as the Network Advertising Initiative’s [consumer opt-out link](http://optout.networkadvertising.org/?c=1#!/), the Digital Advertising Alliance’s [consumer opt-out link](http://optout.aboutads.info/?c=2#!/), or [Your Online Choices](http://www.youronlinechoices.eu/). These tools also allow you to opt out of receiving tailored advertising from companies that participate in those programs. To opt out of Google Analytics for display advertising or to customize Google Display Network ads, visit the Google [ads settings page](https://adssettings.google.com). ## Further Information If you have any questions about how Subtotal uses Cookies, please send us an email at [legal@subtotal.com](mailto:legal@subtotal.com).