Terms and Conditions

This is a translation of the Spanish original, provided for convenience. In the event of any discrepancy, the Spanish version prevails.

1. Identification of the parties

These Terms and Conditions (hereinafter, "the Terms") govern the relationship between:

• The Provider: REVISIT XMD, S.L., tax ID (NIF) B93872174, registered address at C/ Holanda, 1, 08917 Badalona (Barcelona), Spain, email hola@revisit.es, owner of the Revisit platform (hereinafter, "Revisit" or "the Platform").
• The Customer: the business or professional holding an account on the Platform.

2. Description of the service

Revisit is a customer loyalty platform for businesses. Depending on the plan contracted, the service includes:

• Loyalty programme with stamps or points.
• Digital loyalty card for Apple Wallet and Google Wallet.
• Campaigns and communications to the Customer's customers by email, notifications and notices on the card.
• Welcome flow for acquiring new customers.
• Review management and integration with Google Business Profile.
• Analytics and business metrics dashboard.
• Recording of visits and redemptions at the till by QR code or through integration with the point-of-sale terminal.
• Revi, an assistant powered by artificial intelligence.

The features and limits of each plan are set out at revisit.es and may evolve over time.

3. Artificial intelligence assistant

Revi is an artificial intelligence system, and this is stated on the Platform. Its answers and suggestions may contain errors and the Customer must review them before using them. Actions by Revi that change something in the account (creating a campaign, modifying the card, inviting a person) are only carried out when a person on the Customer's side confirms them.

4. Free trial

New accounts enjoy a free trial period of 15 calendar days, or such other period as may be agreed in writing with Revisit. No card is requested and nothing is charged during the trial.

Before the trial ends, Revisit notifies the Customer by email with a link to pay. If payment has not been made when the trial ends, the account is paused in accordance with clause 7.

5. Plans, prices and payment

• Price: the fee is calculated for each active store of the Customer, according to the plan contracted and the price published at revisit.es at the time of charging, plus the applicable VAT.
• Billing option: the Customer chooses to pay month by month or for the year in advance. The monthly fee is charged at the start of each month. The annual fee is charged in a single payment and is non-refundable, including where the Customer cancels before the end of the year.
• Payment method: card, through the payment gateway of Revisit's bank. The card details are stored by that bank; Revisit keeps only a reference and the last four digits.
• Renewal: each fee renews automatically at the end of its period and is charged to the stored card, unless the Customer has cancelled. If the charge fails, it is retried over a few days and the Customer is notified; if it does not succeed, the account is paused.
• Invoice: Revisit issues an invoice for each fee charged, in the name of whoever pays it and with the tax details they provide, for whose accuracy they are responsible. The Client agrees to receive invoices in electronic format: they are sent to the email address of whoever pays and, when the Client pays, they are also available in its dashboard. If a charge is returned, Revisit issues the corresponding corrective invoice.
• Price changes: Revisit may change its prices by giving at least 30 calendar days' notice. The new price applies from the next renewal; amounts already paid do not change.
• Chargebacks: if the Customer reverses a charge through their bank, the period it covered ceases to be paid and the account may be paused.

6. Changes of plan and of stores

• Upgrading with a period already paid requires paying, at that moment, the difference for the days remaining in the period. The new plan is activated when payment is received.
• Downgrading is only possible if the account's usage fits within the limits of the lower plan, and does not entitle the Customer to a refund of amounts already paid.
• New stores: when an additional store is opened with a period already paid, the proportional part for the remaining days is added to the next fee. The Platform shows the amount before confirmation.
• Plan changes are requested from Revisit or, if the account is managed by an agency, from the agency (clause 9).

7. Non-payment, pause and closure of the account

• Pause: if payment has not been made when the trial ends or when a fee falls due, the account is paused. While it is paused, the dashboard and the till only allow payment; the data is retained and the cards of the Customer's customers remain on their phones.
• Closure for non-payment: if the account has been paused for 30 calendar days, it is closed. From then on, the customers' cards stop updating. The Customer may ask for it to be reactivated by writing to hola@revisit.es and paying the outstanding fee.
• Erasure of data: if the account has been closed for non-payment for 90 calendar days, Revisit irreversibly erases the personal data of the Customer's customers and of the Customer's team, and voids their digital cards. Billing data that the law requires to be kept is retained.
• Voluntary cancellation: the Customer may cancel at any time from the Platform. The account stops renewing and the Customer may continue using it until the end of the paid period or of the trial; thereafter, the provisions of this clause apply. Amounts already paid are not refunded.
• While the account is paused or closed, and until erasure, the Customer may request a copy of their data from hola@revisit.es.

8. Sign-up, access and acceptance

Access to Revisit is granted after a sign-up process: the Customer requests it, or is invited by Revisit, one of its sales representatives or a partner agency, and receives a link to activate their account.

The account holder expressly accepts these Terms on the Platform the first time they log in, and Revisit keeps a record of the version accepted and of the date. The members of the Customer's team use the Platform on the Customer's behalf.

9. Management by an agency

The Customer may work with a Revisit partner agency that manages their account and, if so agreed, pays their fees. In that case:

• The agency accesses the account with limited scope: it may manage campaigns, settings and other functions, but not the team, the permissions, the Google account or the Customer's own billing.
• Revisit records the actions the agency performs in the account.
• The Customer remains the holder of the account and of its data, and may withdraw the agency's access at any time from the Platform. From that moment, future fees are borne by the Customer; amounts already paid remain valid until the end of their period.
• The relationship between the Customer and the agency, including the price of the agency's services, is a matter to which Revisit is not a party.

10. Customer obligations

The Customer undertakes to:

• Provide truthful, complete and up-to-date information.
• Act as data controller for their customers' data and comply with the obligations this entails, in particular informing those customers and having the appropriate legal basis, such as consent for commercial communications.
• Not use the Platform for unlawful purposes, to send unsolicited communications or in any manner contrary to these Terms.
• Safeguard their team's access credentials and immediately notify hola@revisit.es of any unauthorised use.
• Not reverse engineer, decompile or attempt to access the source code of the Platform, nor use it to develop a competing product.

11. Provider obligations

The Provider undertakes to:

• Keep the Platform operational and accessible, except for interruptions due to maintenance or force majeure, and give notice of scheduled maintenance as far in advance as possible.
• Process personal data in accordance with the GDPR, the LOPDGDD and the Annex to these Terms.
• Notify the Customer of any security breach affecting their data without undue delay and, at the latest, within 48 hours of becoming aware of it.
• Provide technical support in accordance with the plan contracted.
• Not access the Customer's data except to provide the service, to handle a request from the Customer or to comply with a legal obligation.

12. Data protection

With respect to the data of the Customer's customers, Revisit acts as data processor and the Customer as data controller, under Article 28 GDPR. The terms of that processing engagement are set out in the Annex to these Terms, which forms part of them.

With respect to the data of the Customer and of their team, Revisit is the data controller. More information in the Privacy Policy.

13. Intellectual property

The Platform, its code, its design, the Revisit brand, its logos and its documentation are the exclusive property of the Provider and are protected by intellectual and industrial property law.

The Customer retains full ownership of their data and content, and grants the Provider a limited, non-exclusive and revocable licence to process them solely for the purpose of providing the service.

14. Service availability

The Provider endeavours to maintain service availability of 99.5% per month, excluding scheduled maintenance and events of force majeure. No specific availability level is guaranteed unless expressly agreed in writing.

15. Limitation of liability

To the maximum extent permitted by applicable law:

• The Provider shall not be liable for indirect, incidental, special or consequential damages, including loss of profit and business interruption.
• The Provider's total liability towards the Customer shall not exceed the amount paid by the Customer in the 12 months preceding the event giving rise to liability, except in cases of wilful misconduct or gross negligence.
• The Provider shall not be liable for the content, communications or data processing carried out by the Customer through the Platform.

16. Term and termination

• The contract takes effect upon activation of the account and has an indefinite term, renewing with each payment period.
• The Customer may terminate it at any time by cancelling, with the effects set out in clause 7.
• The Provider may terminate it by giving at least 30 calendar days' notice; in that case it will refund the proportional part of any amount paid in advance that corresponds to the unused period.
• The Provider may suspend or cancel access immediately in the event of a serious breach of these Terms, fraudulent use or unlawful activity.

17. Changes to the Terms

The Provider may amend these Terms by giving the Customer at least 30 calendar days' notice by email or on the Platform, which will ask the Customer to accept the new version.

If the Customer does not agree, they may cancel without penalty before the changes take effect.

18. Governing law and jurisdiction

These Terms are governed by Spanish law. For any dispute, the parties submit to the Courts and Tribunals of Barcelona, waiving any other jurisdiction that may apply to them.

Annex. Processing of personal data on behalf of the Customer

This Annex forms part of the Terms and governs the processing that Revisit (the Processor) carries out on behalf of the Customer (the Controller), in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

1. Subject matter, duration and purpose

The Processor processes the data of the Controller's customers in order to provide the Controller with the Platform service: loyalty cards, recording of visits and redemptions, rewards, communications, reviews, analytics and the assistant. The engagement lasts for as long as the relationship between the parties and ends in accordance with section 11 of this Annex.

2. Data and data subjects

The data subjects are the Controller's customers. The data processed are:

• Identification and contact data: name, email address and telephone number.
• Data that the Controller decides to request: date of birth, gender, postcode and how the customer found out about the business.
• Activity in the programme: visits, stamps or points, rewards, redemptions, campaigns received and whether they were read.
• Preferences: language and consent to commercial communications.
• Technical data of the digital card: the pass and device identifiers needed to update it.

The Platform is not designed for special categories of data, and the Controller must not enter them.

3. Instructions of the Controller

The Processor processes the data only on the documented instructions of the Controller, which are these Terms and the configuration the Controller sets on the Platform, unless required to do otherwise by law; in that case, the Processor will inform the Controller beforehand, where the law so permits. If the Processor considers that an instruction is contrary to the applicable regulations, it will inform the Controller.

4. Confidentiality

The persons authorised by the Processor to process the data are subject to a duty of confidentiality, which continues after their relationship with the Processor has ended.

5. Security measures

The Processor applies technical and organisational measures appropriate to the risk (Article 32 GDPR), including:

• Hosting of the data in the European Union.
• Encrypted communications (HTTPS/TLS), and passwords and credentials stored in encrypted form.
• Separation of each business's data and role-based access control.
• Logging of relevant activity on the Platform.
• Regular backups.
• Restricted access to production systems.

6. Sub-processors

The Controller authorises the Processor to engage the following sub-processors, with which it has contracts imposing equivalent data protection obligations on them:

The Processor will inform the Controller of any addition or change of sub-processor at least 15 calendar days in advance, through the Platform or by email. The Controller may object on reasonable grounds relating to data protection; if no solution is reached, the Controller may cancel without penalty.

7. International transfers

Where a sub-processor processes data outside the European Economic Area, the transfer is based on the EU-US Data Privacy Framework if the provider participates in it and, otherwise, on the Standard Contractual Clauses approved by the European Commission.

8. Data subjects' rights

The Processor will assist the Controller in responding to data subjects' requests for access, rectification, erasure, objection, restriction and portability. If a data subject contacts the Processor, the Processor will forward the request to the Controller. The Platform allows the Controller to view, correct and delete their customers' data and to unsubscribe them from communications.

9. Security breaches

The Processor will notify the Controller, without undue delay and at the latest within 48 hours of becoming aware of it, of any security breach affecting the Controller's data, together with the information available so that the Controller can meet its own notification obligations. It will also assist the Controller, as far as possible, with any impact assessments and prior consultations that may be required.

10. Demonstration of compliance

The Processor will make available to the Controller the information necessary to demonstrate compliance with this Annex and will allow reasonable audits, with 30 days' prior notice and at the expense of the party requesting them, without access to the data of other customers of the Platform.

11. End of the engagement

When the relationship ends, the Processor retains the data while the account is paused and closed, and erases it in accordance with clause 7 of the Terms. Before then, the Controller may request from hola@revisit.es a copy of their data or its early erasure. The Processor may retain, in blocked form, the data necessary to meet legal obligations for the periods those obligations establish.