Pricey Standard Service Schedules

A1 Platform access. During the active service term, Vary grants Customer a nonexclusive, nontransferable right for authorized personnel to access Pricey and for guests to use the agreed booking experience for Customer's business. Customer is responsible for its users, access approvals and credential protection. Customer may not resell access, misuse the service, bypass security or copy or reverse engineer proprietary software except as applicable law permits.

A2 Scope and changes. The service includes only the hosted functionality, integrations and services identified in the applicable Order Form and signed Statement of Work (SOW or Schedule D). New features, integrations or material changes require a written change order describing scope, timing and price. Additional work is charged at the rate or fixed price specified in the Order Form or approved change order, and will not begin without Customer's written authorization. No minimum hours or unapproved expenses apply.

A3 Customer cooperation. Customer will provide authorized system access, accurate inventory and package rules, approved prices and taxes, branding, guest policies, timely decisions and staff for testing and training. Customer will supply its guest-facing terms, cancellation and refund policies and privacy notice, which the booking experience will display at checkout, and keep them current. Customer will maintain required third-party accounts and permissions. Vary will identify access blockers and their schedule impact promptly. Customer remains responsible for lodging, operations and fulfillment of what it sells to guests.

A4 Capacity and booking coordination. Where ordered, Pricey checks availability and coordinates reservations across the connected systems identified in the Order Form and SOW. Vary will implement and test the agreed failure-handling and reservation workflow in Schedule D. Cross-system reservations are subject to API functionality, inventory controls, concurrent channel sales and external availability. This agreement does not guarantee zero overbookings, uninterrupted availability, increased revenue or quantified time savings. Vary remains responsible for its own contractual obligations.

A5 Acceptance. Schedule D will set objective tests and a review period. Customer will provide written approval or describe material nonconformities against those tests. Vary will correct in-scope defects without an additional fee and resubmit for review. Unless the Order Form or Schedule D states otherwise, if Customer neither approves nor identifies material nonconformities within 10 business days after a submission, Vary may send a written reminder, and the submission is accepted if Customer does not respond within 5 further business days. Acceptance alone does not authorize commercial transactions; Go Live requires the approvals stated in the Order Form. Minor issues may be deferred only by written agreement that identifies their treatment.

A6 Payments, refunds and accounting. Guest payments are processed by Stripe as direct charges on Customer's own Stripe connected account, onboarded through Vary's Stripe Connect platform. Customer is the merchant of record and seller to guests, and Customer's name appears on guest card statements. Funds settle to Customer's Stripe account; Vary does not receive, hold or remit guest funds. Customer will complete and maintain Stripe's onboarding and accept Stripe's applicable connected account terms. Any Pricey platform fee is collected as a Stripe application fee only as stated in the Order Form; it is earned when the transaction is processed and is not refunded when Customer refunds a guest, unless the Order Form states otherwise.

Customer is responsible for guest payments, fulfillment, policies, taxes, refunds, disputes, chargebacks, reversals, related Stripe fees and accounting for its transactions. If Stripe debits Vary's platform account for any such amount relating to Customer's transactions, including where Customer's Stripe balance is insufficient, Customer will reimburse Vary within 15 days after invoice. Unreimbursed amounts are unpaid fees under A10 and A15.

Refunds can be initiated directly in Pricey, subject to permissions, processor rules and available funds. A payment refund does not by itself guarantee cancellation or inventory release in each connected system; Schedule D will define the supported workflow and any staff action. Standard order-based reports provide sales data. Customer will have direct access to its Stripe dashboard for transaction, payout and reconciliation reports and chargeback management. Card data is collected through Stripe-hosted or Stripe-tokenized payment fields, and full card numbers are not stored on Vary systems; each party is responsible for its own PCI DSS obligations. Vary does not provide accounting, tax or legal advice or manage chargeback responses unless separately agreed. These terms supersede any conflicting Pricey online onboarding terms for Customer's account.

A7 Fees, invoicing and taxes. Fees, billing timing and payment terms are stated in the Order Form. Unless the Order Form states otherwise, invoices are payable within 15 days in US dollars. Fees exclude taxes. Customer will pay applicable transaction privilege, sales, use or similar taxes on Vary's fees, other than taxes on Vary's net income, and Vary will itemize them on its invoices. Undisputed amounts not paid when due bear a late charge of 1.5% per month, or the maximum lawful rate if lower, from the due date until paid. Customer will notify Vary in writing of any good-faith dispute before the due date, with reasonable detail, and the parties will work to resolve it promptly. Unless the Order Form fixes a rate for a longer period, Vary may change recurring fees after the first 12 months of service by giving at least 90 days' written notice, and Customer may terminate the affected service effective on the change date by written notice given before that date.

A8 Ownership. Customer owns its guest, booking, transaction and business data and its pricing rules and supplied content. Vary owns Pricey, software, source code, APIs, reusable integration components and improvements, including development funded by this agreement. The development fee buys the agreed services and hosted access, not source-code ownership or an exclusive license. Customer grants Vary permission to use Customer data and content only as needed to provide the service and meet legal obligations, subject to Schedule C. Vary may freely use suggestions and feedback about Pricey, without disclosing Customer's confidential information.

A9 Confidentiality. Each party will protect the other's nonpublic business, technical and personal information with reasonable care and use it only to perform this agreement. Access is limited to personnel and advisers bound to confidentiality. This excludes information independently developed, lawfully obtained elsewhere or public without a breach. Legally compelled disclosure is permitted with advance notice where lawful. These duties last three years after termination, and longer for trade secrets and personal data as required by law.

A10 Termination and suspension. Either party may terminate for convenience on the notice period specified in the Order Form or for material breach not cured within 30 days after written notice. Vary may suspend for an immediate security threat or unlawful use, or for an undisputed invoice remaining unpaid 30 days after its due date and at least 10 days after written warning. Suspension will be limited to what is reasonably necessary, with prompt notice and restoration after the cause is resolved. Good-faith disputed amounts alone do not justify suspension; Customer must pay undisputed amounts.

A11 Fees at termination. Service fees accrue through the effective termination date while service remains available, with any partial final month prorated. No fee for future unserved months or early-termination penalty applies. Unless the Order Form states otherwise, if Customer terminates for convenience before Go Live, Customer will pay for work performed through the termination date at the Order Form's hourly rate, not to exceed the development fee. No fee is accelerated solely by termination unless expressly stated in the Order Form. Separately authorized work remains payable only under its express signed payment terms. Prepaid unused service fees will be refunded. The development fee is not refundable after valid Go Live except for a contractual remedy or legal requirement.

A12 Exit and records. For 30 days after termination, Vary will make a standard export of Customer's available booking, order and transaction data available without an additional fee, subject to lawful identity verification. Custom migration is separately scoped. Personal-data return and deletion follow Schedule C. Customer must arrange continuity of its operations; third-party reservations remain governed by the relevant systems and guest policies. Ownership, accrued payment obligations, confidentiality, data-protection duties, liability and dispute terms survive as necessary.

A13 Service warranty. Vary will perform services professionally and use commercially reasonable efforts to keep Pricey materially consistent with the signed scope and documentation. Vary will use commercially reasonable efforts to have the guest-facing pages it builds conform to WCAG 2.1 Level AA; Customer is responsible for the accessibility of content, images and documents it supplies and of its own websites and third-party systems. Customer will report a material failure promptly; Vary will correct or reperform affected work without additional fees. An uncured material breach is subject to termination under A10. EXCEPT FOR EXPRESS COMMITMENTS IN THIS AGREEMENT AND RIGHTS THAT CANNOT BE WAIVED, THE SERVICE IS PROVIDED WITHOUT OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. There is no uptime percentage, service-credit or guaranteed restoration commitment unless separately signed.

A14 Third party claims. Vary will defend Customer against third-party claims that unmodified Pricey, used as authorized, infringes US intellectual property rights, and pay final awards or settlements it approves. This excludes Customer content, unauthorized modifications and combinations not supplied or required by Vary. Customer will similarly defend claims arising from Customer-provided content or unlawful guest operations, except to the extent caused by Vary's breach or misconduct. The protected party must promptly notify, reasonably cooperate and allow defense control. Settlement cannot admit its fault or impose obligations without consent. These obligations are subject to A15.

A15 Liability allocation. EXCEPT FOR UNPAID FEES, FRAUD, WILLFUL MISCONDUCT, GROSS NEGLIGENCE AND LIABILITY THAT CANNOT LAWFULLY BE LIMITED, EACH PARTY'S TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT, INCLUDING SCHEDULE C AND INDEMNITIES, IS LIMITED TO THE CAP STATED IN THE ORDER FORM OR, IF NONE IS STATED, THE FEES PAID OR PAYABLE UNDER THAT ORDER FORM IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. SUBJECT TO THE SAME EXCEPTIONS, NEITHER PARTY IS LIABLE FOR INDIRECT, CONSEQUENTIAL, SPECIAL OR PUNITIVE DAMAGES OR LOST PROFITS OR REVENUE. These limits do not remove express correction, export, refund or reimbursement duties.

A16 General terms. The governing law and court venue are those specified in the Order Form, excluding conflict-of-law rules. The parties will first attempt resolution through their authorized contacts for 30 days, without delaying urgent relief or limitation deadlines. In any action to enforce this agreement, the prevailing party may recover its reasonable attorneys' fees and costs. Notices go to the designated email and postal addresses; email notice is effective on acknowledged receipt, with postal delivery used if not acknowledged. Neither party may assign without reasonable consent, except to a successor assuming all obligations. The parties are independent contractors, and neither may bind the other. Delays beyond reasonable control require prompt notice and mitigation and do not excuse accrued payments. A failure or delay in enforcing a provision is not a waiver. This agreement supersedes prior discussions; amendments require both parties' signatures. Invalid provisions are severable. Electronic signatures and counterparts are permitted. No third party has enforcement rights.

Primary contact: the support email stated in the Order Form. Customer's designated administrators will submit an issue summary, affected order references, business impact and reproduction steps without sending full card data or unnecessary guest information. Vary will acknowledge receipt and coordinate investigation and updates.

Support coverage hours, time zone and any customer-specific response targets are set out in the Order Form. Unless that Order Form states otherwise, the response targets below apply during those coverage hours. Support outside those hours requires a separate written arrangement; this schedule does not promise 24-hour staffing.

Response targets are commercially reasonable objectives measured during the agreed coverage hours, not resolution guarantees. A support hour is an hour within the coverage schedule, and a business day is a day within it. Vary will assess priority with Customer and provide status and next steps. Security incidents also follow Schedule C, independent of these support targets.

Vary will maintain the hosted Pricey service and agreed integrations, investigate failures, apply appropriate fixes and monitor relevant integration changes. Planned maintenance that is likely to interrupt checkout will be communicated in advance where practicable. Emergency maintenance may occur sooner with notice as soon as practicable.

Vary will help diagnose connected booking or payment systems or infrastructure failures and coordinate with those providers where authorized. Their service levels, API access, approvals, inventory behavior and fees remain subject to Customer's applicable third-party arrangements. A material external API change requiring new functionality will be assessed jointly; additional paid work requires an approved change order. Routine in-scope upkeep remains included.

Customer will maintain supported configurations and authorized access, identify an operational contact, participate in troubleshooting and review unresolved bookings. Customer will keep guest policies, prices, tax settings and inventory rules current. Issues caused by unauthorized modifications or Customer systems, on-site support, new integrations, new features and additional training beyond Schedule D may be separately scoped. Vary will identify any proposed charge before work begins.

Before Go Live, the parties will document escalation contacts, the treatment of incomplete or partially confirmed packages, duplicate-prevention checks, refund and cancellation steps, and the procedure for pausing checkout. Neither party will knowingly continue commercial checkout through a material capacity or payment-control failure without an agreed safe workaround.

Vary will maintain documented operating procedures and secure credential management sufficient for the service to be maintained, paused or exported if its primary contact is unavailable. Any backup support contact will be identified in the Order Form or before Go Live.

Customer determines the purposes and means of guest and staff data processing and is the controller or business where those terms apply. Vary acts as processor or service provider for that data. Customer instructs Vary to process data to deliver the signed services, manage reservations and payments, issue confirmations, provide support and maintain security. Additional instructions must be documented and lawful. Vary will promptly identify an instruction it reasonably believes unlawful and may pause that processing while the parties resolve it.

Customer is responsible for its notices, lawful basis, consents where required, authority to share data with the connected booking systems, and instructions to Vary. Each party remains responsible for its own legal compliance. Vary may separately process limited business contact and billing information for its own contract administration under applicable law.

Payments will use processor-hosted or tokenized payment functionality. Vary will not intentionally store full card numbers or card security codes in Pricey. If a proposed workflow requires additional sensitive data, the parties must agree the need, lawful basis and safeguards before enabling it.

Vary will use Customer personal data only for documented service purposes or legal requirements, not sell or share it for cross-context behavioral advertising or use it for unrelated marketing. It will not retain, use or disclose that data outside the direct business relationship with Customer, or combine it with data from other clients except as permitted for a service provider by applicable law. Where the California Consumer Privacy Act or a similar law applies, Vary will comply with its applicable service-provider or processor obligations, provide the level of privacy protection that law requires, notify Customer if it determines it can no longer meet those obligations, and allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Personnel and contractors with access must be bound to confidentiality and granted access only as needed. Guest data may not be used in a testimonial or case study without separate authorization and a lawful basis.

Vary will maintain measures appropriate to the processing risk, including encrypted transmission, encryption of stored production data where supported by the hosting service, restricted privileged access with multifactor authentication, secure secret management, access revocation, relevant logging, vulnerability and patch management, and backup and recovery procedures. Before production processing, Vary will document its actual hosting, data locations, retention, backup frequency and recovery arrangements and provide Customer with a reasonable summary. No audit certification or specific recovery time is represented unless expressly stated in the Order Form.

Customer authorizes only the subprocessors disclosed in the dated subprocessor register identified in the Order Form and replacements or additions handled under this section. Vary will bind subprocessors to protections appropriate to their work and remains responsible for their performance of Vary's processing obligations. Before a new subprocessor receives data, Vary will provide at least 15 days' notice where practicable. Customer may reasonably object on data-protection grounds during that period; the parties will seek an alternative, and if none is practical, Customer may terminate the affected service without penalty.

Connected booking and payment providers are identified in the applicable Order Form and SOW. Their roles and applicable agreements must be documented before production access. A provider processing on Vary's behalf must also be listed as a subprocessor; naming it as a connected provider does not exempt it from this schedule. Restricted international transfers require a valid legal mechanism and any required separate transfer terms before they occur.

Vary will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer data, and in any event within 48 hours of awareness. Notice will include known facts, affected data, likely consequences, mitigation and a contact, with updates as investigation progresses. Incomplete information will not delay initial notice. Vary will contain and remediate the incident and reasonably assist Customer's legal notifications. Customer controls notices to guests and authorities unless law requires Vary to notify directly.

Vary will promptly forward data-subject requests and reasonably assist with access, correction, export, deletion, regulatory inquiries and legally required impact assessments. It will not independently respond to a request about Customer data except on instruction or as legally required. Routine assistance is included; exceptional additional work requires prior agreement, except that Vary will not charge Customer to remedy Vary's breach or condition mandatory assistance on a new fee.

Within 30 days after service ends, Vary will provide Customer's requested standard export and then delete active copies within a further 30 days, unless law requires retention. Backup copies will be isolated from ordinary use and expire within 90 days after active deletion. Legally retained data remains protected, is used only for that purpose and is deleted when no longer required. Vary will confirm deletion on request and identify any lawful retention exception.

Vary will provide information reasonably needed to demonstrate compliance. Customer may conduct a proportionate audit through an independent confidential reviewer, normally once per year with 30 days' notice during business hours. Additional review is allowed after a material incident or when law requires. Audits must protect other clients and security information. Each party bears its costs unless a material Vary breach is found, when Vary bears reasonable audit costs. Schedule A governs liability, without limiting mandatory rights or either party's statutory responsibilities.