Olet Merchant Terms of Service

Effective September 1, 2026Last updated September 1, 2026

These Merchant Terms of Service (the "Terms") are a binding agreement between Olet Ventures LLC, a Wyoming limited liability company ("Olet," "we," "us," or "our"), and the business that registers for or uses the Olet platform ("Merchant," "you," or "your"). The Terms govern your access to and use of the Olet point-of-sale software, mobile applications, merchant portal, website, integrations, and related services (collectively, the "Service").

1. Acceptance and Eligibility

1.1 Acceptance. By clicking to accept, creating a store or account, or using the Service, you accept these Terms and our Privacy Policy, which is incorporated by reference. If you do not agree, do not use the Service.

1.2 Business Use Only. The Service is offered solely to businesses for commercial use. It is not offered to consumers for personal, family, or household purposes, and consumer protection laws that apply only to consumer transactions do not apply to these Terms.

1.3 Eligibility and Authority. You represent that: (a) you are at least 18 years old; (b) you are registering on behalf of a business organized or operating in the United States; (c) you have authority to bind that business to these Terms; and (d) neither you nor the business is subject to U.S. sanctions or located in a country embargoed by the United States.

1.4 One Entity Per Account. Each account may be used by a single legal entity. An account may include multiple store locations operated by that entity. Operating a different legal entity, franchisee, or unrelated business under the same account is not permitted; each entity must register its own account.

2. Definitions

"Merchant Data" means all data submitted to the Service by you or on your behalf, including product catalogs, inventory, sales and transaction records, Staff User data, gift card balances, and End-Consumer Data.
"End-Consumer" means a customer of your business, and "End-Consumer Data" means personal information about End-Consumers that is entered into or generated by the Service.
"Staff User" means an employee, contractor, or other individual you authorize to use the Service under your account.
"Plan" means a subscription tier for the Service, including the Free Plan (shown as Lite on our pricing page) and any paid Plan, as described on our pricing page and in your billing portal.
"Third-Party Service" means any product, service, or platform not provided by Olet, including payment processors, e-commerce and accounting platforms, messaging carriers, and hardware.
"DPA" means the Data Processing Addendum in Exhibit A, which is part of these Terms.

3. Accounts, Locations, and Staff Users

3.1 Account Security. You are responsible for all activity under your account, including activity by Staff Users, and for keeping login credentials, PINs, and API keys confidential. Notify us promptly at help@getolet.com of any unauthorized access.

3.2 Staff Users. You may add Staff Users up to the limits of your Plan. You are responsible for ensuring Staff Users comply with these Terms and for removing access when it is no longer appropriate. Staff Users have no independent rights under these Terms. Data about Staff Users is Merchant Data, and you are responsible for any notices to or consents from Staff Users required by law.

3.3 Locations. Some data (for example, catalogs, customer profiles, and gift cards) is shared across all locations under an account. You are responsible for configuring location-level permissions appropriately.

3.4 Accurate Information. You must provide accurate, current account information and keep it updated, including your legal business name and a working email address, which we will use for notices under these Terms.

4. Plans, Trial, and Free Plan

4.1 Plans. Plans are priced based on multiple factors, including but not limited to the number of locations, registers, and users, and other features. Current Plans, limits, and features are described on our pricing page and in your billing portal, which are incorporated into these Terms. Features included in a given tier may change as described inSection 13.

4.2 Trial. New accounts receive a 14-day trial of a paid Plan. No payment method is required. At the end of the trial, you will have the option to purchase a paid Plan. Trial accounts are subject to Section 12 (Beta Features) and Section 14 (Disclaimers) in full, and we may modify or discontinue trials at any time.

4.3 Free Plan. The Free Plan, shown as Lite on our pricing page, is provided at no charge, with limited features, and without any support commitment. We may change, limit, or discontinue the Free Plan on 30 days' notice. If a Free Plan account records no sales activity for 60 consecutive days, we may delete the account and all Merchant Data after giving notice to your account email; deletion is permanent.

4.4 Downgrades. Downgrading to a lower tier or to the Free Plan may cause loss of access to features, locations, registers, users, or data that exceed the limits of the new Plan. You are responsible for exporting any data you wish to keep before downgrading. We do not automatically downgrade accounts.

5. Fees, Billing, Automatic Renewal, and Cancellation

5.1 Merchant of Record. Paid Plans are sold and billed by our authorized reseller and merchant of record, Paddle.com Market Ltd (and its affiliates, "Paddle"). Paddle collects payment, issues invoices, and handles applicable sales tax and VAT. Your purchase is also subject to Paddle's checkout terms. Olet does not collect or store your full payment card details.

5.2 Fees. You agree to pay the fees for your Plan at the rates in effect when you purchase or renew. Fees are stated in U.S. dollars and are exclusive of taxes, which Paddle will add where required.

5.3 Automatic Renewal. PAID PLANS RENEW AUTOMATICALLY at the end of each billing period (monthly or annual, as selected) for the same period at the then-current rate, and your payment method on file with Paddle will be charged, unless you cancel before the renewal date. For annual Plans, we or Paddle will send a reminder to your account email at least 3 days before the renewal charge.

5.4 Cancellation. You may cancel a paid Plan at any time through your billing portal. Cancellation takes effect at the end of the current billing period; you keep access until then and are not charged again. Cancellation does not entitle you to a refund of fees already paid.

5.5 Price Changes. We may change fees for any Plan by giving at least 30 days' notice to your account email. Changes take effect at your next renewal after the notice period. If you do not agree, cancel before the renewal date.

5.6 No Refunds. ALL SALES ARE FINAL. Except where required by law, fees are non-refundable, including for partial periods. Where Paddle, in its capacity as merchant of record, elects to issue a refund under its own policies, that decision does not modify this Section. A plain-language summary of this Section is published at getolet.com/legal/refunds; this Section governs if the two conflict.

5.7 Chargebacks. If you initiate a chargeback or payment dispute, we may suspend your account until the amount is paid.

6. Non-Payment, Suspension, Termination, and Data Deletion

6.1 Failed Payments. If a renewal payment fails, you have a 7-day grace period during which the Service remains available and Paddle will retry the charge. If payment is not received by the end of the grace period, your account will be locked and you will not be able to use the Service until payment is made or you actively downgrade to the Free Plan. We will notify your account email when the account is locked.

6.2 Deletion After Non-Payment. If a locked account is not paid or actively downgraded within 30 days after the original payment due date, we may permanently delete the account and all Merchant Data. We will send at least one notice to your account email before deletion. During the locked period you may downgrade or request an export of your Merchant Data, but you have no other right of access.

6.3 Termination by You. You may close your account at any time through the merchant portal. Closing your account permanently deletes your Merchant Data from active systems immediately and from backups within 30 days. Export any data you need before closing.

6.4 Suspension or Termination by Us. We may suspend or terminate your access immediately, with notice, if: (a) you materially breach these Terms; (b) we reasonably believe your use is unlawful, fraudulent, or creates risk to Olet, the Service, or others; (c) required by a payment processor, platform partner, law, or court order; or (d) your account is inactive as described in Section 4.3. We may also terminate for convenience on 30 days' notice, in which case we will refund any prepaid fees for the unused portion of your term as your sole remedy.

6.5 Data After Termination. Following termination or account closure for any reason, Merchant Data is deleted from active systems and purged from backups within 30 days, except that: (a) we retain billing, tax, and transaction confirmation records as required by law or for dispute resolution; and (b) we may retain de-identified data under Section 10.4. We have no obligation to retain or provide Merchant Data after termination.

6.6 Survival. Sections 5.6, 6.5, 10, 11, 14 through 19, and any other provisions that by their nature should survive, survive termination.

7. Acceptable Use and Merchant Responsibilities

7.1 Lawful Use. You are solely responsible for your business, the goods and services you sell, your prices, taxes, and your compliance with all laws that apply to your business and your use of the Service. You must not use the Service to sell anything illegal or to process data unlawfully.

7.2 Age-Restricted Goods. If you sell age-restricted goods (such as alcohol, tobacco, or vapor products), you are solely responsible for complying with age verification laws. Any date-of-birth or age-verification features in the Service are tools for your use; they are not a guarantee of compliance.

7.3 Prohibited Data. You must not enter into the Service: (a) protected health information regulated by HIPAA (we are not a business associate and the Service is not designed for it); (b) Social Security numbers, driver's license or passport numbers, or other government identifiers; (c) full payment card numbers, PINs, or security codes; (d) personal information of children under 13 (or, if you know it, of any individual for whom a parent's consent is required by law); or (e) any data that you do not have the right to provide.

7.4 Prohibited Conduct. You must not: (a) resell, sublicense, or provide the Service to third parties; (b) reverse engineer, copy, or create derivative works of the Service; (c) interfere with or circumvent security or usage limits; (d) use automated means to access the Service except through interfaces we provide; (e) use the Service to build a competing product; or (f) use the Service in violation of any payment processor's or Third-Party Service's acceptable use policy.

7.5 Privacy Notices and Consents. You are the business or controller responsible for End-Consumer Data. You must provide all privacy notices and obtain all consents required by law before collecting End-Consumer Data at the point of sale or entering it into the Service, and you must honor End-Consumer rights requests as described in the DPA.

7.6 Electronic Receipts and Messaging. The Service can send email and SMS receipts and messages to End-Consumers at your direction. You are the sender of those messages. Before directing the Service to send any message, you represent that you have obtained the recipient's prior express consent as required by the Telephone Consumer Protection Act, the CAN-SPAM Act, and state law; that you will retain records of that consent; and that you will honor opt-out requests immediately. You must not use receipts or messaging features to send marketing content without the consent required for marketing messages. We may suspend messaging features if we receive carrier complaints or believe messages are being sent without consent.

7.7 Gift Cards and Store Credit. You are the issuer of any gift card or store credit sold or issued through the Service, and you are solely responsible for compliance with the federal Credit CARD Act (including the five-year minimum expiration and fee restrictions), state gift card laws, cash-back requirements, and unclaimed property (escheat) obligations. Olet holds no gift card funds and has no liability to gift card holders.

7.8 Reports Are Not Advice. Sales, cash drawer, inventory, and tax reports are provided for your convenience and are based on the data you enter. They are not accounting, tax, or legal advice, and you are responsible for verifying them and for your own record-keeping.

8. Third-Party Services and Integrations

8.1 Your Accounts With Third Parties. The Service integrates with Third-Party Services such as Shopify, Lightspeed, payment processors, accounting platforms, and other services. To use an integration you must have your own account with the Third-Party Service and authorize the connection. Your use of a Third-Party Service is governed solely by that provider's terms and privacy policy. Olet is not a party to that relationship and is not responsible for a Third-Party Service's acts, omissions, fees, availability, or data practices.

8.2 Availability Not Guaranteed. Integrations depend on third parties that Olet does not control. INTEGRATIONS ARE PROVIDED "AS AVAILABLE." We may modify, suspend, or discontinue any integration at any time, including because the provider changes or withdraws its API, changes its terms, or requires us to. Where practical we will give 30 days' notice of discontinuation, but we may act without notice where a provider's change or a security or legal issue requires it. Discontinuation or modification of an integration does not entitle you to a refund or credit, even if the integration is a feature of a paid tier.

8.3 Data Exchanged Through Integrations. When you connect a Third-Party Service, data flows between the Service and that provider as needed to perform the integration. You authorize those transfers. Data received by a Third-Party Service is subject to its terms, not ours.

8.4 Merchant API and Automation Tools. If we make an API available to you, your use is subject to any API terms we publish. Tools you connect through the API act as your agents, and any third party you connect is your service provider, not ours.

9. Payment Processing

9.1 Processors. In-person and card payments are processed by third-party payment processors that you select and contract with directly (for example, Square, PayPal/Zettle, or Helcim). Olet is not a payment processor, money transmitter, or party to any payment transaction. Card data is transmitted directly between your hardware or the processor's software components and the processor; Olet does not collect, transmit, or store full card numbers, PINs, or security codes.

9.2 Processor Requirements. Processors may require device location permissions, hardware, or other conditions in order to process payments. You are responsible for meeting those requirements and for complying with your processor's terms, acceptable use policies, and PCI DSS obligations that apply to you as a merchant.

9.3 Funds. Olet never holds, settles, or has custody of your sales proceeds. Payouts, holds, reserves, refunds to End-Consumers, and chargebacks are handled entirely by your processor.

10. Merchant Data

10.1 Ownership. As between you and Olet, you own your Merchant Data. Olet claims no ownership of it.

10.2 License to Olet. You grant Olet a non-exclusive, worldwide, royalty-free license to host, copy, process, transmit, and display Merchant Data solely to provide, secure, support, and improve the Service, to comply with law, and as otherwise permitted by these Terms and the DPA.

10.3 Data Processing Addendum. Olet processes End-Consumer Data and other personal information in Merchant Data as your service provider or processor in accordance with the DPA in Exhibit A.

10.4 De-identified and Aggregated Data. Olet may create and use de-identified and aggregated data derived from Merchant Data (for example, usage statistics, performance metrics, and industry benchmarks) for any lawful purpose, including improving the Service and developing new features, provided that such data does not identify you, any Staff User, or any End-Consumer. Olet will (a) take reasonable measures to ensure the data cannot be associated with an individual or household, (b) publicly commit not to attempt to re-identify it, and (c) contractually require any recipient to do the same.

10.5 Backups and Data Loss. We maintain encrypted backups retained for 30 days for disaster recovery. Backups are not a substitute for your own records. You are responsible for exporting Merchant Data you need to retain, and Olet is not liable for loss of Merchant Data except as provided inSection 15.

10.6 Export. While your account is active, you may export Merchant Data using the tools in the merchant portal.

11. Intellectual Property and Feedback

11.1 Olet Property. The Service, including all software, designs, documentation, and trademarks, is owned by Olet and its licensors and is protected by intellectual property laws. You receive only the limited right to use the Service under these Terms; no other rights are granted.

11.2 Feedback. If you provide suggestions, ideas, or feedback about the Service, you grant Olet a perpetual, irrevocable, royalty-free license to use them for any purpose without obligation to you.

11.3 Copyright Complaints. Notifylegal@getolet.com of any claim that content in the Service infringes your rights.

12. Beta and Early-Access Features

We may offer features labeled beta, preview, early access, or similar ("Beta Features"). Beta Features are provided "AS IS" for evaluation, may contain errors, may be changed or withdrawn at any time without notice, are excluded from any support or other commitments, and are not part of the paid Plan features. Do not rely on Beta Features for business-critical operations. Your use of Beta Features is at your sole risk, andSection 15 applies with full force.

13. Changes to the Service and These Terms

13.1 Service Changes. We continually develop the Service and may add, modify, or remove features, and may move features between tiers. We will give at least 30 days' notice before removing a material feature from a paid Plan, except where a change is required by law, a Third-Party Service, or security.

13.2 Terms Changes. We may update these Terms by posting the revised version and updating the "Last Updated" date. For material changes we will give at least 30 days' notice by email or in the merchant portal. Continued use after the effective date constitutes acceptance. If you do not agree, cancel and stop using the Service before the change takes effect.

14. Warranties and Disclaimers

14.1 Mutual. Each party represents that it has the authority to enter into these Terms.

14.2 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND. OLET DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. OLET DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DATA WILL NOT BE LOST, OR THAT ANY INTEGRATION OR THIRD-PARTY SERVICE WILL REMAIN AVAILABLE.

14.3 Connectivity. The Service requires a continuous internet connection and has no offline mode. You are responsible for your internet connectivity, devices, and peripherals, and Olet is not liable for any inability to use the Service, including lost or delayed sales, caused by connectivity or hardware issues.

14.4 No Uptime Commitment. Olet does not commit to any specific service level or uptime.

15. Limitation of Liability

15.1 Exclusion of Damages. TO THE FULLEST EXTENT PERMITTED BY LAW, OLET AND ITS MEMBERS, OFFICERS, EMPLOYEES, CONTRACTORS, AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, SALES, BUSINESS, GOODWILL, OR DATA, OR FOR COSTS OF SUBSTITUTE SERVICES, OR FOR DOWNTIME OR INABILITY TO PROCESS TRANSACTIONS, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

15.2 Cap. TO THE FULLEST EXTENT PERMITTED BY LAW, OLET'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID TO OLET (THROUGH PADDLE) FOR THE SERVICE IN THE THREE (3) MONTHS IMMEDIATELY BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (US$100). FOR FREE PLAN AND TRIAL ACCOUNTS, THE CAP IS US$100.

15.3 Basis of the Bargain. These limitations apply regardless of the failure of essential purpose of any remedy and are an essential basis of the bargain. They do not limit liability that cannot be limited under applicable law, including for a party's fraud, gross negligence, or willful misconduct.

15.4 Time Limit. Any claim arising out of these Terms or the Service must be brought within one (1) year after it accrues, or it is permanently barred.

16. Indemnification

You will defend, indemnify, and hold harmless Olet and its members, officers, employees, and contractors from and against all claims, damages, liabilities, fines, penalties, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) your business, your goods and services, or your dealings with End-Consumers; (b) Merchant Data, including any claim that its collection or use violates law or third-party rights; (c) messages sent at your direction, including any claim under the TCPA, CAN-SPAM, or state messaging laws; (d) gift cards, store credit, taxes, or age-restricted sales; (e) your breach of these Terms or of any Third-Party Service's terms; or (f) the acts or omissions of your Staff Users. Your indemnification obligations are not subject to the cap inSection 15.2. We will notify you promptly of any claim and may participate in the defense with counsel of our choosing at our expense; you may not settle any claim that imposes obligations on Olet without our written consent.

17. Dispute Resolution, Arbitration, and Class Action Waiver

17.1 Informal Resolution First. Before starting arbitration or any other proceeding, the party raising a dispute must send written notice describing it to the other party (to Olet atlegal@getolet.com; to you at your account email). The parties will attempt in good faith to resolve the dispute within 30 days after the notice.

17.2 Binding Arbitration. Any dispute, claim, or controversy arising out of or relating to these Terms or the Service that is not resolved informally will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator. The Federal Arbitration Act governs this Section. The seat of arbitration is in Cheyenne, Wyoming, and hearings may be conducted by video conference. The arbitrator may award any relief available in court on an individual basis. Judgment on the award may be entered in any court of competent jurisdiction.

17.3 Class Action Waiver. ALL DISPUTES MUST BE BROUGHT ON AN INDIVIDUAL BASIS. YOU AND OLET WAIVE ANY RIGHT TO BRING OR PARTICIPATE IN A CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE ACTION OR ARBITRATION. If this waiver is found unenforceable as to a particular claim, that claim will proceed in court underSection 18, not in arbitration.

17.4 Exceptions. Either party may (a) bring an individual claim in small claims court, or (b) seek injunctive or other equitable relief in court to protect its intellectual property or confidential information or to prevent unauthorized access to the Service.

17.5 Jury Waiver. TO THE EXTENT ANY DISPUTE PROCEEDS IN COURT, THE PARTIES WAIVE TRIAL BY JURY.

18. Governing Law and Venue

These Terms are governed by the laws of the State of Wyoming and applicable U.S. federal law, without regard to conflict-of-laws rules. Subject to Section 17, the state and federal courts located in Laramie County, Wyoming have exclusive jurisdiction over any dispute, and each party consents to personal jurisdiction there.

19. General

19.1 Notices. We may give notice to your account email or through the merchant portal; notice is effective when sent. Notices to Olet must be sent to legal@getolet.com orOlet Ventures LLC, 32 N Gould St., Unit R, Sheridan, WY 82801.

19.2 Assignment. You may not assign these Terms without our written consent, except to a successor to your business who agrees in writing to be bound. Olet may assign these Terms without consent, including in a merger, acquisition, or sale of assets.

19.3 Force Majeure. Olet is not liable for any failure or delay caused by events beyond its reasonable control, including internet or Third-Party Service outages, acts of government, labor disputes, natural disasters, or cyberattacks.

19.4 Independent Contractors. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or fiduciary relationship.

19.5 Entire Agreement; Order of Precedence. These Terms, including thePrivacy Policy, the DPA, thepricing page, and any API terms, are the entire agreement between the parties regarding the Service and supersede all prior agreements. If there is a conflict, the DPA controls as to processing of personal information; otherwise the body of these Terms controls.

19.6 Severability; Waiver. If any provision is unenforceable, it will be modified to the minimum extent necessary and the rest remains in effect. Failure to enforce a provision is not a waiver.

19.7 Export and Sanctions. You will comply with U.S. export control and sanctions laws in using the Service.

19.8 Contact. Questions about these Terms:help@getolet.com.

Exhibit A: Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Olet Merchant Terms of Service (the "Terms") between Olet Ventures LLC ("Olet") and the Merchant. It applies to Olet's processing of Personal Information on the Merchant's behalf. Capitalized terms not defined here have the meanings in the Terms.

1. Definitions

"Personal Information" means information within Merchant Data that identifies, relates to, or could reasonably be linked to an individual or household, including End-Consumer Data and Staff User data, as defined under Data Protection Laws.
"Data Protection Laws" means all U.S. federal and state laws governing the privacy or security of Personal Information that apply to the processing under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and its regulations, and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and any other state, each as amended.
"Sell," "Share," "Service Provider," "Processor," "Business," "Controller," "Consumer," "Business Purpose," and "De-identified" have the meanings given in the applicable Data Protection Laws.
"Security Incident" means a confirmed unauthorized access to, or acquisition, disclosure, alteration, loss, or destruction of, Personal Information in Olet's possession or control.
"Sub-processor" means a third party engaged by Olet to process Personal Information on Olet's behalf in delivering the Service.

2. Roles and Scope

2.1 Merchant is the Business or Controller of Personal Information. Olet is a Service Provider or Processor acting on Merchant's documented instructions. The Terms, this DPA, and Merchant's use of the Service's configuration options constitute Merchant's complete instructions.

2.2 The subject matter, duration, nature, purpose, and categories of processing are described inAnnex 1.

2.3 This DPA does not apply to Merchant's own account, billing, and contact information, which Olet processes as an independent Business or Controller as described in thePrivacy Policy.

3. Olet's Obligations

Olet will:

process Personal Information only for the Business Purposes of providing, maintaining, securing, supporting, and improving the Service for Merchant, and as otherwise permitted by Data Protection Laws for a Service Provider or Processor, and not for any other purpose;
not Sell or Share Personal Information;
not retain, use, or disclose Personal Information outside the direct business relationship with Merchant or for any commercial purpose other than the Business Purposes, except as permitted by Data Protection Laws;
not combine Personal Information received from Merchant with personal information received from any other source or collected from Olet's own interactions with individuals, except as permitted by Data Protection Laws (including to perform the Business Purposes or to build or improve the Service without building profiles about individuals);
comply with the obligations applicable to Service Providers and Processors under Data Protection Laws and provide the same level of privacy protection as those laws require of Merchant;
notify Merchant without undue delay if Olet determines it can no longer meet its obligations under Data Protection Laws;
ensure that each person authorized to process Personal Information is bound by confidentiality obligations; and
cooperate reasonably with Merchant's compliance obligations, including responding to Consumer requests, data protection assessments, and inquiries from regulators, at Merchant's reasonable expense where the assistance exceeds the tools built into the Service.

Olet certifies that it understands and will comply with the restrictions in this Section 3.

4. Merchant's Obligations

Merchant will: (a) comply with Data Protection Laws as a Business or Controller, including providing notices to and obtaining consents from Consumers; (b) ensure it has the right to provide Personal Information to Olet for processing under this DPA; (c) not instruct Olet to process Personal Information in violation of law; (d) not enter Prohibited Data (Terms, Section 7.3) into the Service; and (e) use the administrative tools in the Service to respond to Consumer requests. Merchant may, upon reasonable notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information by Olet.

5. Sub-processors

5.1 Merchant authorizes Olet to engage the Sub-processors listed inAnnex 2 and to engage additional or replacement Sub-processors as described below.

5.2 Olet will (a) impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, by written contract; (b) remain responsible for each Sub-processor's performance; and (c) give Merchant at least 15 days' notice of any new Sub-processor by updating Annex 2 (published athttps://getolet.com/legal/sub-processor) and, where practical, by email or in-portal notice.

5.3 If Merchant reasonably objects to a new Sub-processor on data protection grounds within the notice period and the parties cannot resolve the objection, Merchant may terminate the affected Service and close its account; this is Merchant's sole remedy.

6. Security

Olet will implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information and the risks of processing, designed to protect Personal Information against Security Incidents. These include, at a minimum: encryption of Personal Information in transit using TLS and at rest; role-based access controls and authentication for Olet personnel; logging and monitoring of production systems; secure software development practices; and encrypted backups. Olet may update its safeguards from time to time provided the overall level of protection is not materially reduced.

7. Security Incidents

7.1 Olet will notify Merchant of a Security Incident affecting Merchant's Personal Information without undue delay and in any event within 72 hours after Olet confirms the Security Incident. Notice will be sent to the account email and will describe, to the extent known, the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed.

7.2 Olet will take reasonable steps to contain and remediate the Security Incident and will provide Merchant with information reasonably needed to meet Merchant's own notification obligations. Merchant is responsible for any notifications to Consumers, regulators, or others required of it by law. Olet will not notify Consumers on Merchant's behalf or identify Merchant to third parties without Merchant's consent, unless required by law.

7.3 Olet's notice of a Security Incident is not an acknowledgement of fault or liability.

8. Consumer Rights Requests

8.1 The Service includes self-serve tools that allow Merchant to access, correct, export, and delete Consumer profiles in order to fulfill Consumer requests. Merchant is responsible for verifying and responding to Consumer requests.

8.2 If Olet receives a request directly from a Consumer relating to Merchant's Personal Information, Olet will, to the extent permitted by law, either inform the Consumer that the request cannot be acted on because Olet is a Service Provider or Processor and direct the Consumer to Merchant, or forward the request to Merchant. Olet will not otherwise respond to the request except as required by law.

8.3 Where Merchant is required to honor an opt-out preference signal or opt-out of Sale, Share, or targeted advertising, Merchant acknowledges that Olet does not Sell, Share, or use Personal Information for targeted advertising, so no action by Olet is required.

9. Compliance Verification

Olet will make available to Merchant, upon reasonable written request no more than once per year, information reasonably necessary to demonstrate Olet's compliance with this DPA, which may include summaries of Olet's security practices, third-party audit reports or certifications if Olet obtains them, and written responses to reasonable security questionnaires. If Merchant reasonably believes that this information is insufficient to verify compliance as required by Data Protection Laws, the parties will agree in good faith on the scope, timing, and cost of an additional assessment, conducted by a mutually agreed independent assessor, at Merchant's expense, subject to confidentiality obligations and no more than once per year.

10. Retention, Return, and Deletion

10.1 Olet retains Personal Information for the duration of the Terms. Merchant may export or delete Personal Information at any time while the account is active using the Service's tools; deletions are removed from active systems immediately and from backups within 30 days.

10.2 Upon termination or closure of the account for any reason, Olet will delete Personal Information from active systems and purge it from backups within 30 days (or, for accounts terminated for non-payment underTerms Section 6.2, within 30 days after the deletion date stated there, resulting in a maximum of 60 days after the original payment due date), except that Olet may retain (a) Personal Information required to be retained by law and (b) De-identified data under Section 11.

10.3 It is Merchant's responsibility to export Personal Information before termination or closure.

11. De-identified Data

Olet may create De-identified data from Personal Information and use it for any lawful purpose. Olet will: (a) take reasonable measures to ensure the data cannot be associated with an individual or household; (b) publicly commit to maintain and use the data only in De-identified form and not to attempt to re-identify it, except to test the effectiveness of de-identification; and (c) contractually obligate any recipient to comply with these requirements.

12. General

This DPA is subject to the limitations of liability in the Terms; Olet's aggregate liability under the Terms and this DPA together is subject to a single cap. If Data Protection Laws change so that a provision of this DPA no longer satisfies their requirements, the parties will negotiate in good faith to amend it, and Olet may update this DPA on notice to the extent required to comply. This DPA terminates automatically upon deletion of all Personal Information under Section 10.

Annex 1: Description of Processing

Subject matter: Provision of point-of-sale software and related services to Merchant.
Duration: The term of the Terms plus the deletion periods in Section 10.
Nature and purpose: Hosting, storing, organizing, retrieving, transmitting, and deleting Personal Information to operate Merchant's point of sale, customer profiles, loyalty features, electronic receipts, reporting, and integrations selected by Merchant; securing and supporting the Service; and improving the Service as permitted by Data Protection Laws.
Categories of individuals: Merchant's End-Consumers; Merchant's Staff Users.
Categories of Personal Information, End-Consumers: name, email address, phone number, shipping and billing address; date of birth (only where Merchant elects to collect it, for loyalty or age-verification purposes); purchase and order history, transaction amounts, discounts, and timestamps; loyalty and store credit balances; last four digits of a payment card, card brand, and transaction identifiers received from Merchant's payment processor; receipt delivery records.
Categories of Personal Information, Staff Users: name, email address, login credentials and PINs, role and permissions, activity logs, and time-clock records if used.
Sensitive Personal Information: None intended. Merchant must not enter Prohibited Data. Date of birth may reveal age; Olet processes it solely to deliver features requested by Merchant.
Processing location: United States.

Annex 2: Sub-processors

The current list is published at https://getolet.com/legal/sub-processor.

Olet Ventures LLC
32 N Gould St., Unit R
Sheridan, WY 82801
legal@getolet.com (contract and legal notices) ·help@getolet.com (questions)