Version 1.0 Last update date: June 6, 2026 Effective date: [●]

1. Parties and contractual structure

These terms of use ("Terms") govern the access and use of the Dishup platform by restaurants, bars, clubs, food halls, operators in the food & beverage sector and other professional merchants ("Restaurateur" or "Merchant").

The service is provided by Dishup S.r.l., with registered office in [●], tax code and VAT number [●], REA [●], share capital [●], PEC [●], e-mail [●] ("Dishup").

The Terms, any commercial order, tariff plan, offer, membership form, onboarding document, data processing agreement, special conditions and any policy referenced by link or accepted on the platform collectively form the contract between Dishup and the Restaurateur ("Contract"). In case of conflict, the following prevail in order:

1. the particular conditions signed by the parties;
2. the accepted business order or pricing plan;
3. the data processing agreement attached to these Terms;
4. these Terms;
5. the operational policies published or made available on the platform.

The Contract is concluded exclusively between professionals. The Restaurateur declares that he is acting for purposes inherent to his entrepreneurial, commercial, artisanal or professional activity and that he does not qualify as a consumer.

2. Definitions

"Accounts" indicates the user of the Restaurateur or its authorized operators for access to the Dishup interfaces.

"End Customers" indicates customers, guests or users of the Restaurateur who interact with the Restaurateur via the Dishup website or webapp, place orders, payments, top-ups, operational reservations or other enabled actions.

"Contents of the Restaurateur" means menus, prices, images, descriptions, ingredients, allergens, tax information, addresses, company information, promotions, brands, logos and any other content inserted or transmitted by the Restaurant or its authorized users.

"Eatery-Bound Credits" indicates credit functions, wallets, coupons, vouchers, wristbands or similar tools technically linked to a specific restaurant business and usable according to the operating rules made available on the platform.

"Dashboard Manager" indicates the restaurant management interface.

"Devices" means tablets, terminals, printers, Stripe readers, Android devices, smart POS, kiosks, monitors, on-premise devices, and other physical or virtual equipment used with Dishup.

"Services” means the software services, APIs, webapps, dashboards, modules, integrations, infrastructure, payment tools, tax tools, AI tools and features made available by Dishup.

"Session" indicates the operational service unit managed in Dishup, for example table, takeaway, delivery, counter or kiosk, including orders, payments and management statuses.

"Third Parties” means vendors integrated into or referenced by the Services, including Stripe, tax providers, email providers, cloud providers, authentication systems, AI providers, printing systems, and hardware devices.

3. Object

Dishup provides the Restaurateur with a software platform to manage some operational activities of the restaurant, including, depending on the activated plan:

1. public site and customer webapp under the Dishup domain or subdomain;
2. digital menus and order flows for room, takeaway, delivery, counter and kiosk;
3. dashboard manager for staff and managers;
4. management of sessions, orders, kitchen statuses, payment and closing;
5. digital payments via Stripe Connect, Stripe Terminal, paylink or other supported methods;
6. integrations with terminals, printers, room devices, kiosks and smart POS;
7. functionality of Eatery-Bound Credits, vouchers, customer wallets, dishbands or similar tools;
8. tax integrations, billing or receipts through third-party providers;
9. analysis, reporting, operational audit and AI assistant tools;
10. technical support and additional features.

Dishup does not sell food or drinks to End Customers, does not assume administration, delivery or preparation obligations, does not intervene in the quality of the Restaurateur's products and does not become part of the sales or administration contracts between the Restaurateur and the End Customers.

4. Membership and powers of representation

The Contract is concluded when the Restaurateur accepts the Terms by signature, click-wrap, acceptance check, use of the platform after the Terms have been made available, or other suitable method to express consent.

The natural person who accepts the Terms declares and guarantees:

1. to be of age and capable of acting;
2. to be the legal representative of the Restaurateur or to have adequate signing and binding powers;
3. that the information you provide to Dishup, Stripe and Third Parties is complete, truthful and current;
4. that the Restaurateur has the licenses, authorizations, health, fiscal, administrative and commercial requirements necessary to carry out its business.

Dishup may request evidence of the Restauranteur's powers, requirements or authorizations at any time. Failure or insufficient response allows Dishup to suspend or limit the Services.

5. B2B nature, role of Dishup and regulatory limits

Dishup provides technology and platform services. Unless otherwise agreed in writing and to the maximum extent permitted by law:

1. Dishup is not a credit institution, payment institution, electronic money institution, financial intermediary, financial intermediary, regulated collection agent or investment service provider;
2. Dishup does not hold funds from Final Customers on behalf of the Restaurateur, except as may be imposed by Third Party technical flows and in any case within the permitted limits;
3. the payment services are provided by Stripe or other authorized providers, according to their respective contracts;
4. Eatery-Bound Credits represent technical and accounting functions linked to the operation of the Restaurant and do not constitute electronic money issued by Dishup;
5. the Restaurateur remains responsible to End Customers for goods, services, refunds, complaints, chargebacks, guarantees, tax documents, promotional programs and any commercial or regulatory obligation relating to its business.

The Restaurateur undertakes not to present Dishup as a bank, financial intermediary, issuer of electronic money, insurer, tax or legal advisor, or person responsible for the sale of the Restaurateur's products.

6. Accounts, credentials and personnel

The Restaurateur is responsible for configuring the accounts, roles, permissions, PINs, authorized devices and credentials of his collaborators.

The Restaurateur must:

1. keep credentials and devices confidential;
2. use appropriate passwords and PINs;
3. promptly revoke access to terminated or no longer authorized personnel;
4. communicate unauthorized access, theft, loss or compromise without delay;
5. ensure that each operator uses the platform only for lawful purposes and in compliance with the assigned permissions.

Activities carried out via accounts, devices, tokens, readers or tools connected to the Restaurant are presumed to have been carried out by the Restaurant, unless proven otherwise and without prejudice to mandatory legal obligations.

7. Room configuration and operational responsibilities

The Restaurateur is responsible for the correctness of:

1. personal, fiscal, administrative and company data;
2. addresses, times, opening days, delivery areas and collection points;
3. menus, prices, availability, ingredients, allergens, images and descriptions;
4. VAT rates, departments, tax categories and data necessary for receipts or invoices;
5. payment settings, tips, service charges, discounts and commissions applied to End Customers;
6. configuration of printers, kiosks, readers, room devices and local networks;
7. management of orders, delays, cancellations, unavailability, complaints and refunds.

Dishup can provide checks, suggestions, validations, alerts or automation, but these tools do not replace the professional verification of the Restaurateur. The platform is an operational support: the Restaurateur remains solely responsible for carrying out the catering business.

8. Contents, menus, allergens and information to the public

The Restaurateur warrants that the Restaurateur Content:

1. are truthful, up-to-date and not misleading;
2. do not violate the rights of any third party, including trademarks, copyrights, trade rights or trade secrets;
3. comply with applicable health, food, advertising, consumer, fiscal and administrative regulations;
4. include, where required, allergens, ingredients, origins, prices, supplements, delivery costs, availability and mandatory information;
5. do not contain illicit, offensive, discriminatory, fraudulent, defamatory, dangerous content, malware or unauthorized links.

Dishup may refuse, obscure, remove, de-index, technically correct or limit content that is manifestly illegal, potentially harmful, inconsistent with the functionality of the platform, reported by third parties or contrary to the Terms. When reasonable, Dishup informs the Restaurateur of the reasons for the measure adopted, except for security needs, fraud prevention, legal obligations or protection of third parties.

The Restaurateur grants Dishup a non-exclusive, royalty-free, worldwide license, transferable to technical suppliers only, revocable upon termination of the Agreement except for preservation purposes, to use, reproduce, technically adapt, display and distribute the Restaurateur Content to the extent necessary to provide, promote and document the Services.

9. Orders, sessions and End Customers

The Restaurateur is the seller or lender to the End Customers. Dishup is not responsible for:

1. failure or delayed preparation;
2. unavailability of products;
3. errors by the restaurateur's staff;
4. food quality, safety, temperature, storage or delivery;
5. complaints, intoxications, allergies, non-conformities or product liability;
6. cancellations, failed refunds, delivery delays or disservices attributable to the Restaurateur or its suppliers.

The Restaurateur must manage the Final Customers with professional diligence, provide adequate assistance, comply with the applicable regulations and keep Dishup free from disputes relating to the commercial relationships between the Restaurateur and the Final Customers.

10. Payments, Stripe Connect and chargebacks

To accept digital payments, the Restaurant may be required to create or connect a Stripe account, complete KYC procedures, accept applicable Stripe terms, provide complete details, and maintain the account enabled.

The Restaurateur authorizes Dishup, within the limits of the Agreement and active settings, to perform technical activities on the Restaurateur's Stripe Connect relationship, including:

1. creating or connecting your Stripe account;
2. transmission of data necessary for payment, reimbursement, cancellation, reconciliation and reporting;
3. creation of PaymentIntent, Checkout Session, payment link, charge, refund, payout or equivalent operations supported;
4. application, where applicable, of platform commissions or dishup fees;
5. reading status, transactions, disputes, chargebacks and data necessary to provide the Services;
6. disconnection, limitation or technical suspension in case of risk, fraud, revocation, account not ready or legal obligations.

Stripe may impose audits, reservations, delays, limitations, suspensions, chargebacks, withholdings and additional obligations. The Restaurateur is responsible for Stripe commissions, Dishup commissions, disputes, chargebacks, refunds, reversals, network sanctions, negative balances and obligations towards End Customers, except for what is not necessarily attributable to the Restaurateur.

Dishup does not guarantee authorization, completion, crediting times, absence of fraud or irrevocability of payments. The information shown on the platform may depend on Stripe or Third Party data and must be reconciled by the Restaurateur with its accounting.

11. Terminals, readers, kiosks and on-premise devices

The Restaurateur must use compatible, updated, secure and configured Devices according to Dishup and manufacturers' instructions.

The Restaurateur is responsible for:

1. power, network, Wi-Fi, LAN, Bluetooth, printer configuration and local security;
2. physical custody and authorized use of the Devices;
3. compliance with Stripe Terminal instructions, the manufacturer and applicable regulations;
4. replacement, maintenance, updating and safe decommissioning;
5. prevention of tampering, unauthorized access, malware and improper use.

Dishup is not responsible for unavailability, printing errors, hardware malfunctions, local network interruptions, operating system problems, device limitations or incompatibilities introduced by manufacturers or third parties.

12. Eatery-Bound Credits, Wallets, Vouchers and Prepaid Instruments

When the Restaurateur enables Eatery-Bound Credits, the Restaurateur acknowledges that:

1. the credit is linked to the specific business and is not transferable to other merchants, except for expressly enabled functions;
2. the Restaurateur remains indebted to the Final Customer for the commercial use of the credit;
3. Dishup provides technical recording, presentation, collection, expense, chargeback and reporting tools;
4. any Stripe top-ups or refunds depend on the Restaurant's connected account and Stripe rules;
5. vouchers, promotions and non-refundable credits must comply with applicable consumer, tax, accounting and promotional regulations;
6. the Restaurateur must correctly account for collections, liabilities, revenues, VAT, fees, refunds and cancellations.

Dishup may block, limit or disable wallets, vouchers or similar tools if it detects a risk of fraud, abuse, accounting error, non-compliant configuration, Stripe account not ready, reports from End Customers, legal obligations or use incompatible with the nature of the Service.

13. Taxation, receipts, invoices and tax supplements

Dishup can integrate tax providers, invoicing systems, receipt issuing, tax printers or cloud services. These features are technical tools and do not constitute tax advice.

The Restaurateur is solely responsible for:

1. correctness of VAT rates, tax departments, descriptions, amounts, taxable amounts, exemptions and applicable regimes;
2. configuration of tax and company data, addresses, recipient codes, PEC, VAT numbers, tax codes and customer data;
3. issuing, delivery, storage, cancellation, cancellation and rectification of tax documents;
4. compliance with obligations regarding telematic fees, electronic invoicing, registers, record-keeping and local obligations;
5. periodic verification of the outcome of integrations and management of errors, waste, failed deliveries or unavailability of providers.

Dishup does not guarantee that a tax supplement is sufficient for every regime, industry, country, format, use case or interpretation of authority. The restaurateur must validate the configuration with his tax advisor.

14. Plans, fees, commissions and billing

The Restaurateur must pay royalties, fees, commissions, hardware costs, activation costs, professional services, payment fees, platform fees and other amounts indicated in the order, price plan or platform.

Unless otherwise agreed in writing:

1. the fees are net of VAT and other taxes;
2. invoices are payable within the deadline indicated on the invoice or, failing that, within 15 days from the date of issue;
3. payments are not refundable for periods already accrued or features already provided;
4. Dishup may offset or withhold amounts due to the extent permitted by law and contracts with Third Parties;
5. in the event of delay, late payment interest and recovery costs accrue in accordance with the legislation applicable to late payments in commercial transactions;
6. failure to pay allows the Services to be suspended or limited upon reasonable notice, except in cases of urgency, fraud, insolvency or risk to Dishup, Third Parties or End Customers.

Dishup may modify price lists and tariff plans with at least 30 days' notice on a durable medium or via communication on the platform. The Restaurateur may terminate before the change becomes effective if the change is materially adverse, unless it arises from law, Third Parties, security, fraud, taxes, payment costs, or features requested by the Restaurateur.

15. Availability, maintenance and changes to the Services

Dishup provides the Services with professional diligence and may update, modify, replace, suspend or remove features for technical, security, legal, commercial, interoperability, maintenance, product evolution or dependence on Third Party reasons.

Unless otherwise written SLA, the Services are provided "as is" and "as available". Dishup does not guarantee uninterrupted operation, absence of errors, compatibility with every device, achievement of economic results, increase in revenues, absence of operational losses or permanent availability of Third Parties.

Dishup can carry out scheduled or urgent maintenance. Where reasonable, Dishup informs the Restaurateur of scheduled maintenance that may materially impact operations.

16. Correct use, safety and prohibitions

The Restaurateur cannot:

1. use the Services for illicit, fraudulent, deceptive, discriminatory or harmful purposes to third parties;
2. circumvent technical limitations, pricing plans, permits, security controls or anti-fraud systems;
3. engage in unauthorized reverse engineering, scraping, crawling, stress testing, penetration testing, or unauthorized copying;
4. introduce malware, vulnerabilities, bots, anomalous traffic or incompatible loads;
5. use the Services to sell products that are prohibited, unauthorizedly restricted, or contrary to Stripe or Third Party rules;
6. alter payment, tax, order, customer or accounting information;
7. upload unnecessary, excessive, unauthorized or unlawful data;
8. grant access to Dishup's competitors for unauthorized competitive analysis;
9. use Dishup trademarks without written consent;
10. integrate unauthorized external systems that compromise security, stability or compliance.

17. Restrictions, suspension and termination for cause

Dishup may limit, suspend, disable or terminate all or part of the Services, an Account, a venue, a feature, a payment, a device or content when one of the following reasons applies:

1. breach of the Contract;
2. failure to pay;
3. false, incomplete or outdated data;
4. risk of fraud, anomalous chargebacks, abuse, security or money laundering;
5. Stripe account is unverified, revoked, not ready, limited, or inaccessible;
6. order of authority, legal obligation or well-founded request from Third Parties;
7. illegal or potentially harmful content;
8. use of the Services in a manner incompatible with their intended purpose;
9. conduct that may damage Final Customers, Dishup, Third Parties or other restaurateurs;
10. technical urgency or security vulnerability.

When possible and except for urgency, legal obligations, investigations, fraud, security or risk of damage, Dishup provides the Restaurateur with a communication containing the main reasons for the measure and a channel for clarification.

The suspension does not free the Restaurateur from amounts already accrued, from obligations towards Final Customers or from responsibilities that arose before the suspension.

18. Internal complaints, mediation and platform transparency

The Restaurateur can send complaints relating to the Services to the address [●] or via the channels indicated on the platform, specifying the company name, venue involved, account, description of the problem, available evidence and measure requested.

Dishup handles complaints in a manner commensurate with complexity and aims to provide an initial response within 15 working days, except in complex cases, Third Party dependencies, security, investigations or exceptional volumes.

For the purposes of the European rules on transparency for business users of online intermediation services, where applicable:

1. the reasons for suspension, limitation and termination are set out in these Terms;
2. the main parameters of presentation or public visibility are: availability of the venue, publication status, configuration of the Restaurateur, proximity or relevance to the page visited, service hours, completeness of data, technical performance, any promotions or commercial settings activated, compliance and security;
3. Dishup does not sell general organic rankings for a fee, unless any sponsorships or promotions are expressly indicated;
4. the Restaurateur retains ownership of its Content, without prejudice to the technical use by Dishup provided for in the Terms;
5. the data accessible to the Restaurateur are those made available in dashboards, APIs or enabled exports, within the limits of security, privacy, trade secrets, legal obligations and third party rights;
6. Dishup may process aggregated, anonymized data or platform statistics for product improvement, benchmarking, security and analytics, without disclosing identifying data about other merchants.

In the event of disputes not resolved through an internal complaint, Dishup indicates the following bodies where it is available to evaluate a mediation attempt:

1. Milan Chamber of Arbitration - Conciliation Service;
2. Forensic Conciliation Chamber at the Council of the Bar Association of Pescara, or other mediation body registered in the ministerial register and territorially competent.

Mediation does not preclude appeal to the competent judge, except for mandatory procedures provided for by law.

19. Content moderation and Digital Services

If and to the extent that the Services include activities attributable to intermediary services or hosting, Dishup may adopt measures to moderate the content and information provided by the Restaurant or its authorized users.

Measures may include automatic or manual review, blocking, removal, redaction, limitation of visibility, account suspension, request for correction, preservation of evidence or notification to authorities.

The measures are evaluated taking into account the nature of the content, risk for third parties, reports, applicable rules, severity, recurrence, urgency and possibility of remedy. Dishup is not required to monitor content generally, but may intervene when it becomes aware of content that is illegal or contrary to the Terms.

20. Data, reports, export and storage

The Restaurateur can access the operational data made available via Dashboard Manager, API, reports or exports enabled by the plan.

Dishup can store operational data, logs, audit trails, payment evidence, documents, configurations and information necessary to:

1. provide the Services;
2. security, fraud prevention and debugging;
3. tax, accounting, legal and regulatory obligations;
4. management of complaints, chargebacks, disputes and defenses;
5. operational continuity, backup and disaster recovery;
6. aggregated or anonymized statistics.

Upon termination, Dishup makes exports available under the plan or by law for a reasonable period, unless suspended due to non-payment, risk, retention obligations, trade secret, privacy or third party rights. After this period, Dishup may delete, anonymize or archive the data according to its policies and legal obligations.

21. Privacy and processing of personal data

The parties undertake to comply with the applicable legislation on the protection of personal data.

In general:

1. the Restaurateur is the data controller for the personal data of its End Customers, employees, collaborators and suppliers processed for its own purposes of administration, sales, taxation, assistance, marketing of the Restaurateur and management of the venue;
2. Dishup acts as data processor when processing personal data on behalf of the Restaurateur in accordance with the Restaurateur's documented instructions;
3. Dishup can act as an independent data controller for data relating to its commercial relationship with the Restaurateur, security, fraud prevention, administration, invoicing, defense of rights, improvement of the service, technical logs and its own obligations;
4. Third parties such as Stripe may act as independent controllers, processors or sub-processors according to their respective terms and policies.

Annex A to these Terms constitutes an agreement on the processing of personal data pursuant to Article 28 GDPR, where Dishup is acting as a data processor.

The Restaurateur must provide Final Customers, employees and collaborators with correct privacy information and obtain the legal bases, consents, authorizations or communications necessary for the use of the Services.

22. Artificial intelligence and analytics

Dishup may make analytics, operational audit, recommendations, summaries, benchmarks, or AI assistants available.

These tools:

1. have information and operational support purposes;
2. may contain errors, omissions or estimates;
3. they do not constitute legal, tax, accounting, healthcare, financial or strategic advice;
4. they do not replace the professional judgment of the Restaurateur;
5. They must not be used for decisions requiring human evaluation, regulatory review or specialist oversight without review by the Restaurateur.

The Restaurateur is responsible for the decisions made based on the AI ​​outputs. Dishup may record logs, prompts, output, tools used and usage metrics within the limits indicated by the policies and the Agreement.

23. Dishup Intellectual Property

Dishup and its licensors retain all rights to the software, code, APIs, interfaces, designs, databases, models, workflows, documentation, trademarks, logos, know-how, trade secrets, configurations, architectures, algorithms, reports, templates and platform materials.

The Restaurant receives a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to use the Services during the term of the Agreement, solely for its own business and in compliance with the Terms.

Nothing in this provision transfers Dishup or Third Party intellectual property rights to the Restaurateur.

24. Feedback

The Restaurateur can send suggestions, requests, ideas or feedback. Unless agreed in writing, Dishup may use them freely, without obligation of compensation, confidentiality, implementation or attribution, subject to respect for personal data and confidential information.

25. Confidentiality

Confidential information is all non-public information relating to a party's business, product, technology, security, customers, pricing, data, strategies, documentation, credentials, contracts and operations.

The receiving party must use the confidential information only to perform the Contract, protect it with at least as much diligence as it uses for its own similar information and not disclose it to third parties except suppliers, consultants, necessary Third Parties, legal obligations or written consent.

The confidentiality obligations last for 5 years from the termination of the Contract; for trade secrets, credentials, security data and highly sensitive non-public information last as long as that information remains confidential.

26. Restaurateur Guarantees

The Restaurateur guarantees that:

1. will use the Services in a lawful and professional manner;
2. will provide true, complete and updated information;
3. will have the necessary authorizations, licenses, requirements and consents;
4. the Restaurateur Content will not violate any rights or regulations;
5. will comply with Stripe terms, circuit rules, tax, food, privacy, consumer and administrative regulations;
6. will hold Dishup harmless from claims related to its business, its products, End Customers, personnel, contents, payments, taxation and improper use of the Services.

27. Warranty Exclusions

To the fullest extent permitted by law, Dishup disclaims implied or additional warranties beyond those expressly stated, including warranties of merchantability, fitness for a particular purpose, non-infringement, continued availability, freedom from error, universal compatibility, absolute security, economic performance, or automatic tax compliance.

Nothing in the Terms limits liabilities that cannot be excluded by law.

28. Limitation of Liability

To the maximum extent permitted by law, Dishup is not liable for indirect damages, loss of profit, loss of revenue, loss of opportunity, loss of goodwill, reputational damage, loss of data not attributable to willful misconduct or gross negligence on the part of Dishup, business interruption, replacement costs, claims from End Customers or damages arising from Third Parties.

Except for willful misconduct or gross negligence and except for mandatory liability, Dishup's overall liability towards the Restaurateur for any claim relating to the Contract cannot exceed the greater of:

1. the amounts actually paid by the Restaurateur to Dishup in the 6 months preceding the event giving rise to the liability; And
2. 1,000 euros.

The limitations apply to contractual, tortious, pre-contractual, indemnity or other liability, even if Dishup has been advised of the possibility of damage.

29. Indemnity

The Restaurateur indemnifies and holds harmless Dishup, its directors, employees, contractors, suppliers and affiliates from claims, damages, costs, penalties, losses and expenses, including reasonable attorneys' fees, arising from:

1. products, services, food, drinks or activities of the Restaurateur;
2. relationships with End Customers, staff, suppliers or authorities;
3. breach of the Contract;
4. Restaurateur Contents;
5. violation of tax, health, food, privacy, consumer, advertising or administrative regulations;
6. chargebacks, refunds, negative balances, fraud or payment disputes attributable to the Restaurateur;
7. improper use of the Services or Devices;
8. incorrect instructions, configurations or data provided by the Restaurateur.

30. Duration, withdrawal and termination

The Contract starts from the date of acceptance and remains effective for the duration indicated in the order or plan. In the absence of a specific duration, the Contract is for an indefinite period with the right of withdrawal upon 30 days' written notice.

If there is a minimum period, early termination does not release the Restaurant from payment of amounts accrued or due for the minimum period, unless otherwise agreed in writing or serious breach by Dishup not remedied within a reasonable time.

Dishup may terminate the Agreement with immediate effect in the event of:

1. serious or repeated violation;
2. non-payment not remedied within 10 days of reminder;
3. fraud, security risk, illicit use or harm to third parties;
4. loss of requirements, licenses or authorizations;
5. insolvency, liquidation, insolvency proceedings or cessation of business;
6. legal obligation, order of authority or supervening impossibility attributable to essential Third Parties.

Upon termination, the user licenses cease, the Restaurateur must stop using the Services, pay the amounts due, return or dispose of any materials according to instructions and complete the obligations towards End Customers and Third Parties.

31. Effects of termination

Termination does not affect:

1. payments due;
2. accrued responsibilities;
3. confidentiality obligations;
4. indemnity;
5. limitations of liability;
6. privacy and tax obligations;
7. data retention necessary for law, defense, audit, security, payments, disputes and accounting;
8. clauses that by nature must survive.

Dishup may temporarily maintain limited functionality to complete payments, refunds, exports, tax, disputes, accounting closures or operational transitions, without this constituting a renewal of the Agreement.

32. Changes to the Terms

Dishup may modify the Terms due to legal, technical, operational, security, product, Third Party or business model needs.

Except for urgent or favorable changes to the Restaurateur, Dishup communicates the changes with at least 30 days' notice on a durable medium, email or notification on the platform. The Restaurateur may withdraw before it comes into force if the change is materially detrimental.

Use of the Services after the effective date of the changes constitutes acceptance of the new terms.

33. Assignment and subcontracting

The Restaurant may not assign the Agreement, sublicense the Services, or transfer Accounts, premises, tokens or devices without Dishup's prior written consent.

Dishup may assign the Agreement or transfer rights and obligations to parent companies, subsidiaries, affiliates, purchasers of the company or business unit, investors, successors or parties involved in extraordinary transactions, without prejudice to the protection of the rights of the Restaurateur.

Dishup may use suppliers and subcontractors to provide the Services, remaining responsible to the Restaurateur within the limits of the Contract.

34. Communications

Communications to the Restaurateur can be sent to the email, PEC, address, account or channel on the platform indicated by the Restaurateur. The Restaurateur must keep his contact details updated.

Communications to Dishup must be sent to [●] or to PEC [●], except for specific channels indicated on the platform.

35. Force majeure

Dishup is not responsible for delays or failures to perform due to events beyond its reasonable control, including network failures, cloud outages, unavailability of Third Parties, strikes, natural events, fires, pandemics, cyber attacks, blackouts, wars, government measures, malfunctions of payment circuits or unavailability of essential infrastructure.

36. Applicable law and competent court

The Contract is governed by Italian law.

For any dispute relating to the validity, interpretation, execution, non-fulfillment, resolution or termination of the Contract, the Court of Pescara, except for mandatory competences provided for by law.

37. Final clauses

The possible invalidity of a clause does not affect the validity of the remaining provisions. The invalid clause will be replaced, to the extent permitted, by a valid provision that achieves the original economic purpose as much as possible.

Failure to exercise a right does not constitute a waiver. No tolerance constitutes a modification of the Contract.

The Contract constitutes the entire agreement between the parties on its subject matter and replaces previous agreements, except for special written conditions.

38. Specific approval pursuant to articles 1341 and 1342 of the civil code.

The Restaurateur declares to specifically approve, pursuant to and for the purposes of articles 1341 and 1342 of the civil code, the following clauses:

1. article 4 (membership and powers of representation);
2. article 5 (B2B nature, role of Dishup and regulatory limits);
3. article 8 (removal, obscuration and licensing of contents);
4. article 10 (Stripe Connect authorizations, fees, chargebacks and payment responsibilities);
5. article 12 (limitations and blocking of Eatery-Bound Credits);
6. article 14 (payments, interests, suspension for non-payment and tariff changes);
7. article 15 (availability, modifications and absence of SLA unless agreed in writing);
8. article 17 (restrictions, suspension and termination for cause);
9. article 18 (internal complaints and mediation);
10. article 20 (storage, export and deletion of data);
11. article 27 (exclusions of warranty);
12. article 28 (limitation of liability);
13. article 29 (indemnity);
14. article 30 (duration, withdrawal, termination and amounts due);
15. article 31 (effects of termination);
16. article 32 (modifications of the Terms);
17. article 33 (assignment and subcontracting);
18. article 35 (force majeure);
19. article 36 (applicable law and exclusive jurisdiction of Pescara).

---

Annex A - Agreement on the processing of personal data

A.1 Subject

This Annex regulates the processing of personal data carried out by Dishup as data processor on behalf of the Restaurateur, pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR").

A.2 Roles

The Restaurateur is the data controller of personal data of Final Customers, employees, collaborators and other data subjects processed through the Services for the purposes of the Restaurateur.

Dishup is the data processor when it processes such data to provide the Services according to documented instructions from the Restaurateur. Dishup remains the independent controller for its own processing activities indicated in the Terms or in the Dishup information.

A.3 Categories of data and data subjects

The personal data processed may include, depending on the features activated:

1. identification and contact data of End Customers;
2. account, authentication and device data;
3. order, session, payment, wallet, voucher, receipt and invoice data;
4. delivery, collection, table data, operational preferences and notes;
5. Restaurateur staff data;
6. technical logs, audit trails, IP addresses, user agents, security events;
7. any tax data, VAT number, tax code, PEC, recipient code and addresses.

Data subjects may include End Customers, employees, collaborators, legal representatives, representatives of the Restaurateur and authorized users.

A.4 Duration

The processing lasts for the validity of the Contract and subsequently for the period necessary for deletion, return, backup, security, defense of rights, legal obligations, disputes, payments, taxation and audits.

A.5 Documented instructions

Dishup processes personal data only upon documented instructions from the Restaurateur, including those in the Agreement, platform configurations, dashboard or API requests, and authorized communications.

If Dishup believes that an instruction violates applicable privacy laws, it will notify the Restaurateur, unless prohibited by law.

A.6 Dishup obligations

Dishup is committed to:

1. process personal data according to the Contract;
2. ensure that persons authorized to process are subject to confidentiality obligations;
3. adopt technical and organizational measures appropriate to the risk;
4. reasonably assist the Restaurateur in managing data subject requests, data breaches, impact assessments and preventive consultations, taking into account the nature of the processing and the information available;
5. delete or return the data upon termination, subject to retention obligations;
6. make available information necessary to demonstrate compliance with this Annex, within the limits of security, confidentiality and commercial secrecy;
7. allow reasonable audits, preferably through documentation, certifications, reports or questionnaires, with adequate notice and without compromising security or data of other customers.

A.7 Sub-processors

The Restaurateur generally authorizes Dishup to appoint sub-processors to provide the Services, including cloud providers, hosting, security, email, analytics, payment, tax, support, AI and infrastructure.

Dishup imposes on sub-processors obligations substantially equivalent to those of this Attachment. Dishup informs the Restaurateur of relevant changes in a reasonable manner, giving the opportunity to object for documented data protection reasons. If the objection prevents the provision of the Services, Dishup may discontinue or limit the affected features.

A.8 International Transfers

Dishup may transfer personal data outside the European Economic Area only in the presence of adequate safeguards, such as adequacy decisions, standard contractual clauses, additional measures where necessary or other bases provided for by the GDPR.

A.9 Security

Security measures may include, depending on risk and functionality:

1. access control and authorizations;
2. encryption or hashing of credentials and tokens where appropriate;
3. logical segregation of tenants;
4. logging and monitoring;
5. backup and recovery procedures;
6. vulnerability management;
7. communications protection;
8. internal access and confidentiality policies.

The Restaurateur remains responsible for the security of its Accounts, devices, networks, local exports, credentials and configurations.

A.10 Data breach

Dishup shall notify the Restaurateur without undue delay upon becoming aware of a personal data breach involving data processed on behalf of the Restaurateur. The communication contains, where available, the nature of the event, categories and indicative volume of data, likely consequences, measures adopted or proposed and point of contact.

The Restaurateur remains responsible for notifying data subjects and the competent authorities when due.

A.11 Requests from data subjects

If Dishup directly receives a request to exercise rights relating to data processed on behalf of the Restaurateur, it forwards it to the Restaurateur or invites the data subject to contact the Restaurateur, unless otherwise required by law.

A.12 Return and deletion

Upon termination of the Agreement, Dishup deletes or returns personal data processed on behalf of the Restaurant according to available functionality and reasonable technical times, unless retention is necessary for law, defense, security, backup, payments, tax, disputes or audits.

---

Attachment B - Stripe Connect Specific Conditions

B.1 Acceptance of Stripe Terms

Use of Stripe Payments requires acceptance of the applicable Stripe Terms, including the Connected Account Agreement and other related Stripe Terms. In the event of a conflict between Stripe terms and the Agreement regarding Stripe services, the Stripe terms may prevail in the relationship between Stripe and the Restaurant.

B.2 Responsibilities of the Restaurateur towards Stripe and End Customers

The Restaurant must provide Stripe and Dishup with accurate and complete data, maintain current KYC information, comply with network rules, properly handle refunds and complaints, and maintain disputes, chargebacks, negative balances, fines, reversals or amounts due under the Stripe terms and the Agreement.

B.3 Dishup activity on Stripe

The Restaurateur authorizes Dishup to carry out the technical activities necessary to provide the Services via API or Stripe dashboard, including management of payments, refunds, readers, terminals, statuses, application fees, reconciliations, webhooks, reports and security.

B.4 Stripe Suspension

If Stripe limits, suspends, revokes or disables the Restaurant's account, Dishup may disable or limit digital payments, wallets, kiosks, delivery, takeout, readers or other Stripe-dependent features, without liability for unavailability resulting from such event.