In this Agreement, unless the context otherwise requires:

"Agreement" means these Terms of Service together with the Privacy Policy and Disclaimer, as updated from time to time.

"Company", "VYROX", "we", "us", "our" means VYROX INTERNATIONAL SDN BHD, a company incorporated in Malaysia under New Business Registration Number 201201039321 (formerly 1023799-A), Tax Identification Number (TIN) C22988575060, SST Registration Number W24-1808-32000228, and its directors, officers, employees, contractors, agents, successors and assigns.

"Software" or "Service" means the snooker / cue-sports venue management software-as-a-service offered by the Company under the brands VIP SNOOKER, SNOOKERKING, VIP SNOOKERKING (and any successor or rebranded products), including the web application, mobile applications, APIs, hardware-integration drivers, dashboards, reports, supporting websites, documentation, updates, and any related cloud infrastructure.

"Client" or "Subscriber" means the snooker centre, club, venue, organisation, sole proprietorship, partnership or company that subscribes to or pays for the Service, and any individual representing that entity who clicks-through, signs, accepts, deploys, or otherwise uses the Service on its behalf.

"Authorised User" means any individual whom the Client permits to access the Service, including but not limited to system administrators, owners, managers, operators, cashiers, supervisors, employees, contractors, and any other staff member.

"Member" / "End-Customer" means an individual customer or member of the Client who interacts with the Service through self-service portals, mobile apps, QR-code ordering, loyalty programmes, booking systems, public TV monitors, or any other customer-facing feature.

"User" means, collectively, Clients, Authorised Users, and Members.

"Customer Data" means all data the Client (or its Authorised Users / Members) submits, uploads, generates or causes to be processed through the Service, including operational data, financial records, member personal data, transaction histories, photographs, biometric templates, communications and any other information.

"Personal Data" has the meaning given in the Personal Data Protection Act 2010 of Malaysia (Act 709) ("PDPA").

"PDPA" means the Personal Data Protection Act 2010 of Malaysia (Act 709) and any subsidiary legislation, codes of practice and binding guidelines issued thereunder.

"Subscription Fees" means the recurring or one-off fees payable for the Service as set out in the applicable order form, invoice, quotation, plan page or written agreement.

2.1 Click-through acceptance. By ticking the acceptance checkbox shown at first login (or at any subsequent re-acceptance prompt following an updated version of this Agreement), by signing any order form referencing the Service, by paying any Subscription Fee, or by accessing or continuing to use the Service in any manner whatsoever, You acknowledge that You have read, understood and agree to be legally bound by this Agreement.

2.2 Authority. If You accept on behalf of a company, partnership, sole proprietorship, snooker centre, club, venue or any other entity, You represent and warrant that You have full legal capacity and authority to bind that entity, and that entity is bound by this Agreement.

2.3 Capacity & age. You confirm You are at least 18 years of age and have full legal capacity to enter into a binding contract under Malaysian law. Where the Client is a minor or an entity incapable of contracting, the Service must not be used.

2.4 Cascading acceptance. The Client is responsible for ensuring that every Authorised User and every Member of the Client accepts and complies with this Agreement, the Privacy Policy and the Disclaimer. The Client shall procure all necessary consents (including PDPA consents) from its Authorised Users, employees, members and customers before their Personal Data is entered into the Service. The Client indemnifies the Company against any claim arising from any failure to obtain such consents.

2.5 Updates. The Company may amend this Agreement at any time by publishing a new version on its website and/or by prompting re-acceptance inside the Service. Continued use after notice or after re-acceptance prompt constitutes binding acceptance of the amended Agreement. Where re-acceptance is required, refusal to accept will, at the Company's discretion, result in restriction or termination of the Service.

Without prejudice to any other warranty disclaimer or limitation in this Agreement, the User acknowledges and agrees that:

• the Service may at any time include undiscovered or unresolved issues, integration discrepancies and edge-cases that the Company will work to address through its ongoing maintenance programme;
• any feature, function, screen, calculation, report, e-invoice, hardware integration, AI / ML output or workflow may change, be improved, be replaced, be temporarily unavailable, or be discontinued at any time and without prior notice;
• the Service is provided on an "AS IS" and "AS AVAILABLE" basis and, to the maximum extent permitted by Malaysian law, the Company makes no warranty — express, implied or statutory — that the Service will be uninterrupted, will be accurate, will pass any audit, will increase revenue, will retain members, or will be fit for any particular purpose beyond the published documentation in force from time to time;
• the User shall verify the output of the Service (invoices, e-invoices, tax computations, reports, member records and the like) before acting upon it, and shall not bring or support any claim against the Company based solely on the evolving nature of the Service or on a feature having changed, been improved, or temporarily failed to meet a particular expectation, save where mandatory Malaysian law preserves a right of action;
• if at any time these terms cease to be acceptable to the User, the appropriate course is to discontinue use of the Service and contact the Company.

Continued use of the Service after this acknowledgement is conclusive evidence of the User's informed acceptance of these conditions.

3.1 Limited licence. Subject to the Client paying all Subscription Fees and complying with this Agreement, the Company grants the Client a limited, revocable, non-exclusive, non-transferable, non-sublicensable, royalty-bearing licence during the subscription term to access and use the Service solely for the lawful operation of the Client's snooker / cue-sports venue.

3.2 Authorised Users. The Client may permit its Authorised Users to access the Service in accordance with the Client's subscription tier. The Client is fully responsible for the acts and omissions of its Authorised Users as if they were the Client's own.

3.3 Reservation of rights. All right, title and interest in and to the Service (including source code, object code, algorithms, schema design, user interface, look-and-feel, documentation, branding, trademarks and all derivatives) are and shall remain the exclusive property of the Company. No rights are granted by implication, estoppel or otherwise. The Service is licensed, not sold.

3.4 No transfer. The Client shall not assign, novate, sublicence, lease, lend, resell, white-label or otherwise transfer the licence to any third party without the Company's prior written consent.

4.1 Lawful operation. The Client warrants that it operates a lawful business in compliance with all licensing, entertainment, gaming, taxation, consumer protection, employment, health-and-safety and any other applicable laws of Malaysia (or such other jurisdiction as the Client operates).

4.2 Account security. The Client and every Authorised User shall keep usernames, passwords, PINs, API keys and authentication tokens strictly confidential. The Client is liable for all activity occurring under any account created by or for the Client, including activity by former employees who have not been deactivated. The Client shall promptly deactivate access for any departing employee or contractor.

4.3 Accurate data. The Client warrants that all data uploaded to the Service (member registrations, prices, tax codes, opening balances, etc.) is accurate and lawfully obtained.

4.4 Prohibited uses. The Client and its Authorised Users shall not, and shall not permit any person to:

• copy, modify, translate, port, decompile, reverse engineer, disassemble, or otherwise attempt to derive the source code or trade secrets of the Service;
• circumvent any licence, usage limit, security feature, watermark or rights-management mechanism;
• resell, rent, lease, time-share, or use the Service to provide services to third parties (other than the Client's own customers in the ordinary course of operating its venue);
• use the Service to commit or facilitate any illegal act, including but not limited to illegal gambling, money-laundering, fraud, tax evasion, harassment, defamation, distribution of obscene material, or unauthorised data mining;
• upload viruses, malware, or any harmful code; perform load-testing, scanning or penetration-testing without prior written consent;
• tamper with, falsify, back-date or fabricate any timer, billing, revenue, payment, invoice, e-invoice (LHDN MyInvois), member, or audit-trail record within the Service;
• use scraping, robots, or any automated mechanism to extract data, except via documented APIs and within published rate limits;
• use the Service for benchmarking against the Company or for the purpose of building a competing product.

4.5 Hardware integrations. Where the Service controls physical devices (lighting, scoring controllers, IoT relays, payment terminals, printers, etc.), the Client is solely responsible for the safe installation, electrical certification, fire-safety compliance, and supervision of such hardware.

5.1 Necessity. The Service is delivered as Software-as-a-Service. To deliver, host, secure, monitor, debug, back-up, restore, optimise, upgrade and provide 24×7 support to the Service, the Company requires and shall have full technical and operational access to the underlying servers, databases, file systems, logs, message queues and infrastructure containing the Customer Data. The Client expressly acknowledges, agrees to and authorises such access.

5.2 Scope of access. Without limiting the foregoing, the Company's engineers, system administrators, support staff, contractors and authorised AI / automated agents (collectively, "VYROX Personnel") may at any time and without further notice:

• read, query, extract, modify, repair, restore or delete records in any table or column of the database, including but not limited to member personal details, transaction history, payment records, photographs, biometric templates, chat messages, GPS coordinates, login history and any other Customer Data;
• access raw application logs, error logs, web-server logs, database slow-query logs and any other diagnostic data;
• impersonate Authorised Users or Members for the strict purpose of reproducing reported bugs, validating fixes or performing forensic investigation;
• create, retain and use anonymised, aggregated, statistical or de-identified copies of Customer Data for product improvement, machine-learning training, industry benchmarking, fraud detection and research;
• retain operational backups (encrypted) for disaster recovery for a rolling period;
• use third-party cloud providers, content-delivery networks, monitoring services, error-tracking services, customer-support tools and AI service providers, who may incidentally process Customer Data on the Company's behalf and under written data-processing terms.

5.3 Confidentiality & security. VYROX Personnel exercise database access strictly under (a) confidentiality obligations equivalent to those in this Agreement, (b) the Company's internal access-control, role-based authorisation and audit-logging policies, and (c) the security standards described in the Privacy Policy. The Company shall use commercially reasonable measures to limit access to those personnel who genuinely need it.

5.4 Data Controller / Data Processor relationship. Under the PDPA, the Client is the Data User / Data Controller of all Personal Data of its Members, Authorised Users and customers stored in the Service. The Company acts as the Client's Data Processor with respect to such Personal Data and processes it only as instructed by the Client and as reasonably necessary to provide the Service. The Client warrants that it has obtained from its Members, Authorised Users, employees and any other data subjects all notices, consents and lawful bases required under the PDPA (and any other applicable data-protection law) before entering their Personal Data into the Service, including consent to the processing described in this Section 5 and in the Privacy Policy.

5.5 Indemnity for cascading consent. The Client shall indemnify, defend and hold harmless the Company and its directors, officers, employees, agents and contractors from and against any and all claims, demands, regulatory enforcement actions, fines, damages, losses, costs and legal fees arising out of or in connection with any allegation that the Client failed to obtain proper consent or to give proper notice (under the PDPA or otherwise) to any Member, Authorised User, employee or other data subject whose Personal Data is processed through the Service.

5.6 No covert surveillance. Nothing in this Section authorises the Company to use the access for any improper purpose, including surveillance unrelated to the Service, sale of identifiable Personal Data to third parties for marketing, or any unlawful purpose.

6.1 Fees. The Client shall pay all Subscription Fees, set-up fees, training fees, hardware fees, transaction fees, e-invoice fees, payment-gateway fees, and any other charges as quoted by the Company.

6.2 Taxes. All fees are stated exclusive of Sales and Service Tax (SST), Service Tax, Goods and Services Tax (GST) (if reintroduced), withholding tax and any other Malaysian or foreign taxes, which shall be payable by the Client in addition.

6.3 Late payment. Overdue invoices shall accrue interest at 1.5% per month (or part thereof) compounded monthly, or the maximum rate permitted by law, whichever is lower. The Company may suspend or terminate the Service for any unpaid amount overdue more than fourteen (14) days, without prejudice to any other remedy.

6.4 No refunds. Except where mandatory under Malaysian consumer law, all fees are non-refundable. Pro-rated refunds are not provided for partial periods, unused features, downtime, holidays, downgrades or early termination.

6.5 Price changes. The Company may revise pricing on giving thirty (30) days' written or in-app notice for the next renewal cycle.

7.1 Service IP. The Service and all derivatives, improvements, updates, enhancements, bug fixes and feature additions, whether developed at the Company's initiative or in response to feedback, are and shall remain the sole and exclusive property of the Company.

7.2 Customer Data. As between the parties, the Client retains all right, title and interest in and to its Customer Data. The Client grants the Company a worldwide, royalty-free, non-exclusive licence to host, copy, transmit, display, modify and process Customer Data solely as needed to deliver the Service and exercise the Company's rights under this Agreement (including the access described in Section 5).

7.3 Aggregated data. The Client agrees that the Company owns all right, title and interest in any anonymised or aggregated dataset derived from Customer Data, provided such dataset cannot reasonably be used to identify the Client, any Member or any individual.

7.4 Feedback. Any suggestion, idea, feature request, bug report or feedback ("Feedback") provided by any User to the Company is hereby irrevocably and royalty-free assigned to the Company, which may use it without obligation, attribution or compensation.

8.1 Limited warranty. The Company warrants that the Service will substantially conform to its published documentation under normal use. The Client's sole and exclusive remedy for breach of this warranty is, at the Company's option, repair or re-performance of the affected functionality.

8.2 EXCLUSION OF IMPLIED WARRANTIES. EXCEPT FOR THE EXPRESS WARRANTY IN SECTION 8.1, AND TO THE FULLEST EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". THE COMPANY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, RELIABILITY, NON-INFRINGEMENT, AVAILABILITY, UNINTERRUPTED OPERATION, ERROR-FREE OPERATION, AND SECURITY AGAINST UNAUTHORISED ACCESS BEYOND COMMERCIALLY REASONABLE MEASURES.

8.3 No business-result warranty. The Company does not warrant that the Service will increase revenue, attract members, comply with the Client's specific accounting policies, produce LHDN-validated e-invoices in every situation, or pass any specific audit. The Client is responsible for verifying outputs (including invoices, e-invoices, tax computations and revenue reports) before relying on them.

9.1 Cap. TO THE MAXIMUM EXTENT PERMITTED BY MALAYSIAN LAW, THE COMPANY'S AGGREGATE LIABILITY UNDER OR IN CONNECTION WITH THIS AGREEMENT (WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE OR OTHERWISE) SHALL NOT EXCEED THE TOTAL SUBSCRIPTION FEES ACTUALLY PAID BY THE CLIENT TO THE COMPANY DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

9.2 Excluded losses. IN NO EVENT SHALL THE COMPANY BE LIABLE FOR ANY: (a) LOSS OF PROFIT, REVENUE, BUSINESS, GOODWILL, CONTRACT OR ANTICIPATED SAVINGS; (b) LOSS, CORRUPTION, INACCURACY OR UNAUTHORISED DISCLOSURE OF DATA, EXCEPT AS DIRECTLY CAUSED BY THE COMPANY'S WILFUL MISCONDUCT; (c) LOSS DUE TO INTERNET OUTAGE, THIRD-PARTY SERVICE FAILURE, FORCE MAJEURE, OR HARDWARE FAILURE NOT SUPPLIED BY THE COMPANY; (d) FINES OR PENALTIES IMPOSED BY LHDN, BANK NEGARA, THE PERSONAL DATA PROTECTION COMMISSIONER OR ANY OTHER REGULATOR; OR (e) ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.

9.3 Reasonableness. The Client acknowledges that the limits in this Section 9 are reasonable having regard to the Subscription Fees and the nature of the Service, and that without these limits the Company would not enter into this Agreement.

The Client shall indemnify, defend and hold harmless the Company, its directors, officers, employees, contractors, partners, suppliers and agents from and against any claim, demand, action, suit, regulatory enforcement, fine, penalty, loss, damage, cost and expense (including reasonable legal fees on a solicitor-and-client basis) arising out of or in connection with:

• any breach by the Client or any Authorised User of this Agreement, the Privacy Policy or the Disclaimer;
• any failure by the Client to obtain proper PDPA consent or to issue proper privacy notice to its Members, Authorised Users, employees or any other data subject;
• any inaccuracy, illegality or infringement in any Customer Data;
• any claim by a Member, Authorised User, employee, customer or other third party that the Client misused, lost, leaked or improperly disclosed their Personal Data;
• any claim arising from the Client's operation of its venue, including but not limited to entertainment licensing, illegal gambling, employment disputes, harassment claims, slip-and-fall, food-and-beverage incidents, or hardware-related injury;
• any claim that any Authorised User exceeded their authority in using the Service;
• any claim that the Company's vendor access to the database (as authorised in Section 5) was not properly disclosed by the Client to its data subjects.

The Company may, at its option, take control of the defence of any indemnified claim, in which case the Client shall reasonably co-operate at its own expense.

11.1 Term. This Agreement begins on the date of first acceptance and continues until terminated.

11.2 Suspension. The Company may suspend access immediately and without notice if (a) any fee is overdue; (b) the Company reasonably suspects any fraudulent, abusive or unlawful use; (c) the Company reasonably believes the Service is being used to infringe a third party's rights; (d) any security threat or vulnerability requires emergency action; or (e) any regulator orders suspension.

11.3 Termination for cause. Either party may terminate immediately on written notice if the other commits a material breach not cured within fourteen (14) days of written notice (or such shorter period as is reasonable for irremediable breaches), or becomes insolvent, enters liquidation or has a receiver appointed.

11.4 Termination for convenience. Either party may terminate at the end of the then-current paid period on thirty (30) days' written notice.

11.5 Effect of termination. On termination: (a) all licences cease; (b) the Client must immediately stop using the Service; (c) the Client may within thirty (30) days request an export of its Customer Data in a commercially reasonable format (subject to any export fee); thereafter the Company may permanently delete Customer Data, save for backup copies retained per its standard backup policy and any records the Company is required by law to keep.

11.6 Survival. Sections 5 (Vendor Access), 7 (IP), 8 (Warranties), 9 (Limitation), 10 (Indemnity), 12 (Confidentiality), 13 (Governing Law) and any other provision which by its nature should survive, shall survive termination.

12.1 Each party shall keep confidential the other party's non-public business, technical and commercial information ("Confidential Information"), and shall not disclose it except to its personnel and advisors on a need-to-know basis under equivalent confidentiality obligations.

12.2 Confidential Information does not include information that is or becomes public through no fault of the receiving party, was rightfully known before disclosure, is lawfully received from a third party without restriction, or is independently developed.

12.3 The receiving party may disclose Confidential Information if compelled by law, regulator, court or tribunal, provided (where lawful) it gives the other party prompt notice and reasonable opportunity to object.

13.1 Governing law. This Agreement is governed by and construed in accordance with the laws of Malaysia, without regard to its conflict-of-laws principles.

13.2 Jurisdiction. The parties submit to the exclusive jurisdiction of the courts of Kuala Lumpur, Malaysia for any dispute, save that the Company may bring proceedings in any court where the Client has assets or operates.

13.3 Mediation first. Before commencing court proceedings, the parties shall first attempt in good faith to resolve any dispute by senior-management negotiation for at least thirty (30) days, and may by mutual agreement refer the dispute to mediation under the Asian International Arbitration Centre (AIAC) Mediation Rules.

13.4 Equitable relief. Notwithstanding Section 13.3, either party may seek urgent injunctive or equitable relief at any time.

In addition to all other provisions, the following feature-specific terms apply when the Client enables or uses the corresponding feature:

(a) Face Recognition & Biometric Identification. The Client warrants that, before any face image or biometric template of any Member, employee or visitor is captured, enrolled or processed through the Service, the Client has obtained that person's explicit, informed, written or click-through consent (and parental / guardian consent where the person is a minor), has displayed a CCTV / biometric notice, has performed any data-protection impact assessment required by law, and has lawful basis to process such Sensitive Personal Data under the PDPA. The Client indemnifies the Company in full against any biometric-related claim.

(b) Public TV Monitor & Leaderboards. Where the Service displays member names, photographs, rankings, statistics, table status, no-show counts, spend leaderboards, tournament brackets or any other personally identifying information on a public-facing screen, kiosk, mobile app, web URL or QR-shared link, the Client warrants that every individual whose information is so displayed has consented in writing or by click-through to such public display, and that the Client has the right to show such information to anyone present at the venue or anyone with access to the public URL.

(c) Member, Customer & Food-Ordering Mobile / Web Apps. Customer-facing applications (member portal, F&B QR-ordering app, table-monitor, public TV monitor) are part of the Service. The Client is responsible for ensuring such apps display the Client's own customer-facing terms and privacy notice, and for moderating any User-Generated Content (chat, reviews, comments, photos) submitted through them.

(d) Chat, Social, Tournaments & User-Generated Content ("UGC"). Where Members chat, post or share content within the Service, the Company is a mere conduit and is not liable for any UGC. The Client / Member submitting UGC grants the Company a worldwide, royalty-free licence to host, transmit and display such UGC for the purpose of operating the Service. The Company may, but is not obliged to, remove any UGC the Company believes to be unlawful, abusive, defamatory, harassing, infringing, obscene or in breach of this Agreement.

(e) WhatsApp, SMS & Email Notifications. Where the Service sends messages on behalf of the Client (booking confirmations, OTPs, marketing campaigns, no-show alerts), the Client warrants that recipients have given the consents required by law (including the PDPA, the Communications and Multimedia Act 1998 and any anti-spam regulations). The Client is solely responsible for the message content. The Company may pass through carrier / WhatsApp / email-provider charges and may impose throttling.

(f) E-Invoice / LHDN MyInvois. Where the Service prepares, validates or submits e-invoices to the Inland Revenue Board of Malaysia (LHDN) MyInvois portal, the Client remains the legal taxpayer / supplier of record, is solely responsible for the accuracy of TIN, classification codes, tax rates, exempt-status declarations, customer details, and for retaining originals as required by the Income Tax Act 1967. The Company makes no warranty of acceptance, validation, downstream availability or compliance with future versions of the LHDN schema.

(g) Payments, Cards & E-Wallets. Card and e-wallet transactions are processed by independent payment-gateway providers under their own terms. The Company is not the merchant of record, holds no PCI-cardholder data on its servers (other than masked references), and is not responsible for chargebacks, settlement timing, currency-conversion rates, gateway downtime, fraud losses, or any dispute between the Client, the cardholder and the gateway / acquirer.

(h) IoT Lighting, Timers, Controllers & Hardware Integration. The Service may control physical lighting, table-occupancy detectors, scoreboard displays, kitchen-display systems, printers, signage and other IoT devices. The Client is solely responsible for: (i) electrical certification, fire-safety compliance, surge protection and code compliance of all such hardware; (ii) supervising children, intoxicated patrons and physically vulnerable individuals around such hardware; (iii) maintaining redundant manual switches in case of network or controller failure; (iv) any direct or consequential damage caused by hardware mis-firing, lights staying on, lights failing to turn off, timer drift, or lockout. The Company is not a hardware manufacturer and gives no electrical-safety, IP-rating or product-warranty representation.

(i) Artificial Intelligence, Machine Learning & Automated Decisions. Where the Service uses AI / ML for member matching, demand forecasting, fraud detection, ranking, pricing recommendations or text generation, all output is provided for assistance only; the Client / Authorised User must apply human judgement before acting on it. AI output may be wrong, biased, hallucinated or stale.

(j) Public APIs, Webhooks & Integrations. Use of any public API, webhook or third-party integration is subject to published rate limits and may change without notice. The Company may break, deprecate or rate-limit any API to protect the Service.

(k) Beta / Preview Features. Any feature labelled "beta", "preview", "alpha", "experimental" or similar is provided strictly on an "AS-IS" basis with no warranty of any kind, may be removed at any time, and shall not be relied upon for production use.

The Client warrants that it shall not use the Service in connection with, or knowingly facilitate, any of the following:

• any form of illegal gambling, betting, lottery, slot machine, jackpot or wagering, in violation of the Common Gaming Houses Act 1953, the Betting Act 1953, the Lotteries Act 1952, the Pool Betting Act 1967 or any other Malaysian gaming legislation;
• operation without a valid Local Council entertainment / business licence, liquor licence (where applicable), music / public-performance licence (MACP / PRISM), or hawker / food-establishment licence as required by the relevant authority;
• service to under-aged patrons in violation of any restriction on children entering entertainment establishments;
• money laundering, terrorism financing, or any breach of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA);
• tax evasion, false invoicing, fictitious-customer entries, or any breach of the Income Tax Act 1967, the Sales Tax Act 2018 or the Service Tax Act 2018;
• employment of unauthorised foreign workers, or breach of the Employment Act 1955, the Minimum Wages Order, EPF / SOCSO / EIS contributions or any other Malaysian employment law.

The Company may suspend or terminate the Service immediately on reasonable suspicion of any prohibited operation, and shall co-operate with lawful enforcement requests.

The Client is, and shall remain at all times, the sole employer or principal of every person it engages (including managers, operators, cashiers, supervisors, kitchen staff, cleaners, security and contractors). The Service merely records shifts, commissions, attendance and audit-trails for the Client's convenience. Nothing in the Service makes VYROX an employer, joint employer, principal, agent, partner, recruiter, or co-worker of any such person. The Client is solely responsible for: payroll, EPF, SOCSO, EIS, HRDF, PCB / MTD withholding, foreign-worker permits, occupational safety, harassment-free workplace, leave entitlements, termination, and all employment-related taxes, benefits and disputes. The Client indemnifies VYROX in full against any claim by any of its workers or alleged workers.

The Client represents and warrants that it is not located in, ordinarily resident in, or otherwise subject to a comprehensive trade embargo of Malaysia, the United Nations Security Council, the United States, the European Union, or the United Kingdom; that it is not a person or entity on any restricted-party / sanctions list; and that it shall not use the Service in violation of any applicable export-control or sanctions law.

Unless the Client otherwise elects in writing, the Company may identify the Client as a customer of the Service in marketing materials, case studies, customer-logo lists, social-media posts and the Company's website, provided such use is consistent with the Client's brand guidelines, if any have been provided.

Primary jurisdiction. The Service is operated from Malaysia and the primary governing law remains the laws of Malaysia. The Client and any Authorised User accessing the Service from outside Malaysia (including, without limitation, Australia, Singapore, the United Kingdom, the United Arab Emirates, the Sultanate of Brunei, the Republic of Indonesia, the Kingdom of Thailand, the Republic of the Philippines, the Socialist Republic of Vietnam, the Hong Kong SAR, India, New Zealand and Canada) does so on its own initiative and is solely responsible for compliance with the laws of its local jurisdiction, including (without limitation) telecommunications, taxation, gambling and entertainment licensing, employment, consumer protection, data protection and import/export controls.

No marketing into restricted jurisdictions. The Company does not target marketing at, and does not solicit business in, any jurisdiction where the Service or its constituent features (including AI processing, biometric processing, payment intermediation, e-invoicing or cross-border data transfers) are unlawful or require additional licensing the Company has not obtained.

Non-Malaysian Clients. Where the Client is incorporated or operates outside Malaysia, the Client warrants that it has obtained any registrations, licences, consents and approvals required by its local regulator(s) before deploying the Service.

Some jurisdictions confer mandatory rights on a User which cannot be excluded, restricted or modified by contract (including, where applicable):

• Malaysia: the Consumer Protection Act 1999 (where the Client is a "consumer" under that Act);
• Australia: the consumer guarantees in the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth));
• United Kingdom: the Consumer Rights Act 2015 (where the Service is supplied to a consumer);
• Singapore: the Consumer Protection (Fair Trading) Act 2003 and the Sale of Goods Act, where applicable;
• United Arab Emirates: Federal Law No. 15 of 2020 on Consumer Protection (where applicable);
• European Union member states (where applicable): the consumer-protection regime of the Member State where the consumer resides.

Nothing in this Agreement is intended to exclude or restrict any such mandatory statutory right. Where any disclaimer, exclusion or limitation in this Agreement would, but for this clause, breach a mandatory statutory right, that disclaimer, exclusion or limitation shall apply only to the maximum extent that the relevant law permits, and the Company's liability shall, in respect of that mandatory right, be limited to the minimum permitted by that law (which, for B2B supplies under the Australian Consumer Law, the Company elects to be re-supply or replacement of the affected Service, or the cost thereof, at the Company's option, where this election is permitted under section 64A).

To avoid doubt, the Service is intended primarily for business / B2B use by snooker / cue-sports venue operators; it is not marketed to private consumers. Where a User is acting as a consumer in any jurisdiction with stronger consumer-protection rules, that User accepts that the Service is offered on B2B terms and that personal-consumer carve-outs apply only to the minimum extent the law requires.

To the maximum extent permitted by law, every claim or dispute arising out of or relating to the Service or this Agreement shall be brought solely in the User's individual capacity, and not as a plaintiff or class member in any purported class, collective, consolidated, multi-claimant or representative proceeding. The User waives, to the extent permitted by law, any right to participate in such a proceeding. This clause does not apply where the law of the User's mandatory consumer-protection jurisdiction prohibits such waiver; in that case, this clause is severable and the remainder of this Agreement remains in force.

The User agrees that ticking the acceptance checkbox on first login (and on any re-acceptance prompt), clicking "I Agree", paying any Subscription Fee, or otherwise indicating acceptance through the Service, constitutes a valid, binding and enforceable signature and acceptance under the following statutes (and their successors), as applicable:

• Malaysia: the Electronic Commerce Act 2006 and the Digital Signature Act 1997;
• Singapore: the Electronic Transactions Act 2010;
• United Kingdom: the Electronic Communications Act 2000;
• Australia: the Electronic Transactions Act 1999 (Cth) and the State / Territory equivalents;
• United Arab Emirates: the Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services;
• European Union: Regulation (EU) No. 910/2014 (eIDAS);
• Other Southeast-Asian jurisdictions: the local equivalent electronic-transactions or e-commerce statute.

The Company's server-side audit trail of acceptance events (including doc version, accepted-at timestamp in Malaysia local time, IP address and user-agent string) is admissible as evidence of acceptance.

The Client warrants that it shall not, in connection with the Service or this Agreement, offer, promise, give, request, agree to receive or accept any financial or other advantage that would constitute a violation of:

• the Malaysian Anti-Corruption Commission Act 2009;
• the United Kingdom Bribery Act 2010;
• the United States Foreign Corrupt Practices Act 1977 (FCPA), where applicable;
• the Singapore Prevention of Corruption Act;
• the Australian Criminal Code Act 1995 (Cth) (Division 70);
• the Federal Decree-Law No. 31 of 2021 on Crimes and Penalties of the United Arab Emirates and the UAE's anti-bribery framework;
• the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (Malaysia) and equivalent anti-money-laundering / counter-terrorist-financing legislation of any jurisdiction in which the Client operates;
• the FATF Recommendations as implemented locally.

The Client shall maintain its own anti-bribery, anti-corruption and AML policy proportionate to its size and exposure, and shall co-operate with reasonable diligence requests from the Company. Breach of this Section is a material breach permitting immediate termination.

The Client represents and warrants on a continuing basis that neither it, nor any of its directors, beneficial owners, officers, Authorised Users or known business associates, is (a) located, ordinarily resident or organised in a comprehensively sanctioned jurisdiction, (b) a person or entity on any restricted-party / sanctions list maintained by the United Nations Security Council, the United States Office of Foreign Assets Control (OFAC), the European Union Council, His Majesty's Treasury (UK), the Australian Department of Foreign Affairs and Trade, or the Monetary Authority of Singapore, or (c) acting on behalf of any such person or entity. The Client shall not use the Service in violation of any export-control or sanctions law. The Company may suspend or terminate access immediately on reasonable suspicion of breach, and shall notify and co-operate with relevant authorities as required.

Currency. Subscription Fees are quoted and payable in Malaysian Ringgit (MYR) unless otherwise expressly agreed in writing. Where the Client elects to pay in a foreign currency, the Client bears all foreign-exchange conversion costs, gateway fees and intermediary-bank charges; the Company's books shall be reconciled using the actual MYR amount received.

Taxes. All fees are exclusive of any sales tax, service tax, value-added tax (VAT), goods-and-services tax (GST), digital-services tax (e.g. Malaysia's 8% Service Tax on imported digital services, Singapore's GST on Imported Digital Services, the United Kingdom's VAT, the European Union's VAT under the OSS / IOSS scheme, the United Arab Emirates' 5% VAT, Australia's 10% GST, and any successor or equivalent levy), withholding tax, stamp duty or any other tax, all of which (where chargeable) shall be borne by the Client and grossed-up so that the Company receives the full amount due.

Withholding. If applicable law requires the Client to withhold tax on payments to the Company, the Client shall (i) gross-up the payment so that the Company receives the full invoiced amount net of any withholding, or (ii) where the Company so elects, pay the gross amount and provide the Company with the original tax certificates required to claim a foreign-tax credit.

The Service is provided on an "AS AVAILABLE" basis. Unless the Company has signed a separate, written Service Level Agreement (SLA) expressly identifying uptime targets, response times, support windows or service credits with a specific Client, the Company makes no commitment as to availability, latency, response time, support hours, time-to-fix, or any other quality-of-service metric. Scheduled or emergency maintenance windows, third-party-provider outages, internet-routing disruptions and force-majeure events may all reduce availability and shall not give rise to any service credit, refund or liability. Any availability statistics published by the Company in marketing materials are aspirational and non-contractual.

Without limiting the general force-majeure provision earlier in this Agreement, neither party is liable for failure or delay in performance caused by any event beyond reasonable control, including (without limitation):

• natural disasters (earthquake, flood, lightning strike, fire, hurricane, monsoon, tsunami, volcanic activity, geomagnetic storm);
• acts of war, hostilities, terrorism, civil unrest, insurrection, riot, sabotage, blockade or siege;
• pandemic, epidemic, public-health emergency or government-imposed movement-control or curfew order;
• government action, ministerial order, regulatory directive, sanction, embargo, court order, or change of law;
• strike, lock-out or labour dispute (whether involving the parties' own workforce or otherwise);
• cyber-attack, distributed-denial-of-service attack, ransomware, supply-chain compromise, zero-day exploit, third-party security incident, BGP route hijack or DNS-poisoning event;
• outage, throttling, degradation or termination of service by any cloud-infrastructure provider, content-delivery network, undersea-cable operator, internet-exchange-point operator, telecommunications carrier, certificate authority, mobile-network operator, registrar or domain authority;
• power outage, fuel shortage, water shortage or other utility failure;
• shortage of equipment, components or materials beyond reasonable control;
• any act, omission or insolvency of any sub-processor, vendor or supplier on whom the Company reasonably relies.

The affected party shall use reasonable endeavours to mitigate the effect of the event and to resume performance as soon as practicable.

To the maximum extent permitted by applicable law, no claim, demand, suit or proceeding arising out of or in connection with this Agreement or the Service shall be commenced more than twelve (12) months after the cause of action first arose, irrespective of any longer statutory limitation period that might otherwise apply. Any claim not commenced within that period is permanently barred. This time bar does not apply where the law of the User's mandatory jurisdiction prohibits a contractual limitation shorter than the statutory period; in that case the minimum statutory period applies.

Each party shall take all reasonable steps to mitigate any loss or damage it may suffer in connection with the Service, and shall co-operate in good faith with the other to limit the consequences of any incident, breach or claim. The Company's liability for any loss is reduced to the extent that the User has failed to take such reasonable mitigation steps (including, where applicable, prompt notification, prompt application of available patches, prompt deactivation of compromised accounts, and prompt export of business-critical data).

The Client shall, at its own cost, maintain such insurance cover as is appropriate to its business operations, including (without limitation) public-liability insurance, employer-liability insurance, business-interruption insurance, professional-indemnity insurance (where applicable), and cyber-liability insurance covering its handling of Personal Data and customer-payment information. The Company is not the Client's insurer and disclaims any obligation to top up or substitute for any insurance the Client should have carried.

Audit by Company. The Company may, on reasonable notice and not more than once per calendar year (save where regulatory enforcement, security incident or reasonable suspicion of breach justifies more frequent audits), audit the Client's use of the Service for compliance with this Agreement, including verifying licence-tier scope, identifying unauthorised users, and checking compliance with PDPA and other data-protection requirements. Audits shall be conducted during business hours and shall not unreasonably interrupt the Client's operations.

Audit by Client. Where applicable data-protection law (e.g. Article 28 GDPR) entitles the Client to audit the Company as Data Processor, the Company shall, in lieu of an on-site audit, make available a written summary of its current security posture, latest third-party audit reports (where available), and answers to a reasonable security questionnaire. On-site audits may be arranged by mutual agreement at the Client's cost, subject to confidentiality.

Continuous monitoring. The Company continuously monitors the Service for security threats, abuse, fraud and breach of this Agreement, and may take any reasonable protective action without notice (including session termination, IP blocking, rate limiting, account suspension and forensic preservation).

The Company engages third-party sub-processors (cloud-infrastructure, monitoring, error-tracking, customer-support, transactional-email, SMS / WhatsApp, AI-processing, payment-gateway and similar) to deliver the Service. By accepting this Agreement, the Client gives general written authorisation for the Company to engage and replace such sub-processors as required to deliver the Service, subject to the Company imposing on each sub-processor data-protection obligations equivalent to those in this Agreement. A current list of categories of sub-processors is available on request to the contact email in this Agreement. The Company shall remain liable to the Client for the acts and omissions of its sub-processors as if they were its own, subject to the limitations of liability in this Agreement.

Where the Company issues a tax invoice, the Client shall ensure the invoice is recorded promptly in its accounting records. For B2B Clients located in the European Union, the United Kingdom, Singapore, the United Arab Emirates, Australia or any other reverse-charge VAT/GST jurisdiction, the Client is responsible for self-accounting for the applicable reverse-charge VAT / GST under its local rules and providing the Company with a valid VAT / GST registration number on request. Where a Client supplies an invalid VAT / GST number, or fails to discharge its reverse-charge obligation, the Client shall indemnify the Company against any tax assessment (including penalties and interest) that the Company suffers as a result.

Where a Client operates in a jurisdiction whose laws or commercial practice incorporate Sharia principles or any other religious-law framework (including parts of the United Arab Emirates, Brunei, Saudi Arabia, certain Malaysian state-level enactments and certain Indonesian provinces), the Client warrants that it has independently determined that its use of the Service, its operation of its venue, its handling of revenue, and its treatment of members and customers comply with such religious-law framework. The Company makes no representation or warranty that any feature of the Service is Sharia-compliant, halal-certified, riba-free, or otherwise compatible with any religious-law requirement.

Save as expressly stated in this Agreement, no person who is not a party to this Agreement (including, without limitation, any Authorised User, Member, customer, employee, contractor, supplier, sub-processor or affiliate) shall have any right under the United Kingdom Contracts (Rights of Third Parties) Act 1999, the Singapore Contracts (Rights of Third Parties) Act 2001, or any equivalent legislation in any other jurisdiction to enforce any term of this Agreement. The directors, officers, employees and contractors of the Company are intended third-party beneficiaries of Sections 8 (Warranties), 9 (Limitation of Liability), 10 (Indemnity), and any other section conferring an exoneration, indemnity or limitation on them, and are entitled to enforce those sections directly.

Nothing in this Agreement creates a partnership, joint venture, franchise, distributorship, employment, agency or fiduciary relationship between the parties. Neither party has authority to bind the other or to create obligations on behalf of the other.

14.1 Entire agreement. This Agreement (with the Privacy Policy and Disclaimer and any signed order form) is the entire agreement and supersedes all prior representations and understandings, written or oral.

14.2 Severability. If any provision is held invalid or unenforceable, the remainder continues in force, and the invalid provision shall be reformed to the minimum extent necessary.

14.3 No waiver. A waiver is effective only if in writing and signed by an authorised representative.

14.4 Force majeure. Neither party is liable for failure or delay caused by events beyond reasonable control, including natural disaster, war, terrorism, pandemic, government order, internet outage, cloud-provider outage, ransomware attack on third-party infrastructure, or labour disputes.

14.5 Assignment. The Client may not assign without the Company's prior written consent. The Company may assign on notice (including to an affiliate, successor or acquirer).

14.6 Notices. Notices to the Company must be sent to enquiry@vyrox.com or to the registered address. Notices to the Client may be given through the Service or to the email on record.

14.7 Independent contractors. The parties are independent contractors. Nothing creates a partnership, agency, joint venture or employment relationship.

14.8 No third-party beneficiaries. No person other than the parties has any right under this Agreement, save that the Company's directors, officers, employees, contractors and affiliates may directly enforce Sections 8, 9 and 10.

14.9 Language. This Agreement is executed in English. Any translation is for convenience; the English text governs.