Privacy Policy

This Privacy Policy explains how VenueSSS, Inc. (“VenueSSS,” “we,” “us,” “our”) collects, uses, discloses, and otherwise processes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with an individual (“Personal Information”). Jurisdictional Scope: This Privacy Policy is intended for U.S.-based operations. VenueSSS's Platform is operated from the United States and is not intended for use outside the United States. This Privacy Policy applies to Personal Information we process when you access or use our websites, applications, and related services (collectively, the “Platform”), including when you create an account, browse listings, message, request or make bookings, list services, or otherwise interact with us. If you are using the Platform on behalf of a business or other entity, “you” includes you and that entity. This Privacy Policy is incorporated into and forms part of the VenueSSS Terms of Service. In the event of any conflict between this Privacy Policy and the Terms of Service:

• The Terms of Service control with respect to: disclaimers, limitations of liability, releases, indemnification, dispute resolution, arbitration, governing law, and VenueSSS's rights and obligations.
• This Privacy Policy controls with respect to: categories of Personal Information collected, purposes of processing Personal Information and privacy rights procedures. All defined terms in the Terms of Service apply to this Privacy Policy unless otherwise specified.

1. Roles on the Platform

The Platform may be used by different types of users, including:

• Customers (end users seeking to book venues and/or services); and
• Providers (venue hosts and/or service providers offering venues and/or services).
• VenueSSS: As described in the Terms of Service Sections 3 and 10, VenueSSS operates a marketplace platform and is not a party to contracts between Customers and Providers. VenueSSS is not an agent, broker, insurer, or fiduciary of any Provider.

This matters because the categories of Personal Information we collect and the purposes for which we process it may vary by role.

1.1 Privacy-Specific Disclaimers and Limitations

Incorporation of Terms of Service Protections: All disclaimers, limitations of liability, releases, waivers, indemnification obligations, and dispute resolution provisions in the Terms of Service (including Sections 14, 15, 16, 17, and 19) apply fully to VenueSSS's collection, use, disclosure, and processing of Personal Information, to all privacy-related features, requests, and services, and to cookies, similar technologies, and related data collection and processing practices. The provisions in this Section 1.1 supplement, and do not replace or limit, those broader protections. Data Processing Disclaimers: While VenueSSS implements commercially reasonable security measures appropriate to the nature of the Personal Information processed, VenueSSS does not guarantee and expressly disclaims any warranty, representation, or commitment regarding: (a) the accuracy, completeness, or availability of Personal Information provided by users or third parties; (b) successful processing of privacy requests beyond the timeframes and standards required by applicable law; (c) the security practices, compliance, or data handling of independent third-party service providers (including payment processors, verification services, analytics providers, hosting providers, and third-party cookie providers) that process data under their own legal authority; or (d) that privacy request fulfillment will not affect Platform functionality or user experience where such effects result from legal compliance obligations. Liability Limitations for Privacy Matters: TO THE MAXIMUM EXTENT PERMITTED BY LAW, VENUESSS SHALL NOT BE LIABLE FOR ANY CLAIMS, DAMAGES, LOSSES, OR LIABILITIES ARISING FROM OR RELATED TO: (a) unauthorized access to, disclosure of, or loss of Personal Information where VenueSSS has implemented security measures that comply with applicable legal standards, except to the extent caused by VenueSSS's gross negligence or willful misconduct; (b) acts or omissions of independent third-party service providers (including payment processors, verification services, hosting providers, analytics providers, and third-party cookie providers) that process Personal Information under their own legal authority and terms; (c) re-identification of properly de-identified or anonymized data by third parties; (d) delays, denials, or limitations on privacy requests where permitted by applicable law or necessary for legitimate business purposes recognized by law; (e) inaccuracies in user-provided information or user content; (f) actions or omissions by other users; or (g) any other privacy-related matters not caused by VenueSSS's failure to comply with applicable privacy law requirements. Liability Cap: Subject to applicable law, VenueSSS's total liability for claims arising from or related to this Privacy Policy, our processing of Personal Information, or privacy request handling (excluding claims for statutory damages under CCPA, GDPR Article 82 damages, or

other non-waivable statutory remedies) shall not exceed the greater of (a) the Platform fees you paid to VenueSSS in the six (6) months before the event giving rise to the claim or (b) $100. This limitation applies to all causes of action in the aggregate to the extent permitted by applicable law, including breach of contract, breach of warranty, negligence, strict liability, misrepresentation, and other torts. Scope: This Section 1.1 applies exclusively to privacy and data processing matters. For all other disclaimers and limitations of liability (including those related to Platform use, bookings, Provider performance, marketplace transactions, payment processing, cancellations, and disputes), see the Terms of Service Sections 14, 15, and 16, which are incorporated herein by reference and apply in full. Dispute Resolution: Subject to applicable law, disputes, claims, or controversies arising from or relating to this Privacy Policy, VenueSSS's collection, use, disclosure, retention, or processing of Personal Information, privacy request handling, verification procedures, data security, or other privacy-related matters are subject to the dispute resolution, informal resolution, and arbitration provisions in Section 19 of the Terms of Service. All arbitrable disputes must be arbitrated on an individual basis and cannot be brought as class actions, collective actions, or representative proceedings, except as provided in Section 19.6 (Mass Arbitration Procedures) of the Terms and except where such waiver is unenforceable under applicable law.

2. Categories of Personal Information We Collect

We may collect the following categories of Personal Information (depending on how you interact with the Platform):

2.1 Identifiers and Contact Information

Examples: name, email address, phone number, postal address, account username, and similar identifiers.

2.2 Account and Profile Information

Examples: profile details, business name, business contact info, profile photo, preferences, and settings.

2.3 Transaction and Booking Information

Examples: booking requests, booking confirmations, dates/times, amounts, platform fees, refunds, chargebacks, dispute information, and communications relating to bookings.

2.4 Payment and Financial Information

Examples: payment method type, partial payment card information (e.g., last four digits), billing address, and payment status. Note: Payment processing is typically handled by one or more third-party payment processors. We may not store full payment card numbers (see Section 6).

2.5 Communications

Examples: messages between users (including through Platform messaging), support requests, emails, chat communications, call logs/recordings (if any), and related metadata.

2.6 Provider Compliance and Business Information

If you are a Provider, we may collect: licensing/permit information, insurance information (e.g., certificate of insurance), tax forms, business verification details, service descriptions, and related documentation you provide.

2.7 User Content

Examples: photos, listings, reviews, ratings, comments, and other content you submit to the Platform.

2.8 Device, Usage, and Analytics Data

Examples: IP address, device identifiers, browser type, operating system, log data, pages viewed, clickstream data, referring URLs, approximate location derived from IP, performance diagnostics, URL parameters, referral codes, and redirect URLs, referral source information (how you arrived at the Platform), navigation path data and redirect tracking.

2.9 Cookies and Similar Tracking Technologies

We and our service providers may collect information via cookies, pixels, SDKs, and similar technologies (see Section 7).

2.10 Verification-Related Information

We may collect information to help verify identity or business legitimacy, including but not limited to government-issued identification documents, photographic images (selfies), business registration information, and third-party screening results. When we collect government-issued identification or biometric information (such as facial recognition data from selfies), we do so only with your prior informed consent, which you may withdraw at any time, and for the limited purposes of identity verification, fraud prevention, and platform security. Such biometric data will be retained only for the period necessary to fulfill these purposes or as required by applicable law, and will be securely deleted thereafter. We will implement appropriate technical

and organizational measures to protect this sensitive data. We are not obligated to perform verification in all cases, and verification is not a guarantee of safety, identity, quality, or legality.

2.11 Sensitive Personal Information

Certain information may be considered "sensitive" under applicable privacy laws (e.g., precise geolocation, government ID numbers, biometric identifiers such as facial recognition data, payment account log-in credentials). We collect and process sensitive Personal Information only for purposes permitted by applicable law, including:

• Providing Platform services and functionality
• Fraud prevention, security, and risk management
• Compliance with legal obligations
• Verification and authentication (where conducted)
• Enforcing Terms of Service
• Other purposes described in this Policy or for which we obtain consent where required We do not use or disclose sensitive Personal Information for purposes other than those permitted by applicable law.

2.12 Email Engagement Data

We may collect information about your interactions with emails we send, including:

• Email open events (whether and when you open emails)
• Email link click events (which links you click and when)
• Device and location information derived from email interactions (when available). This data is collected automatically through tracking technologies (such as tracking pixels and link rewriting) implemented by our email service provider. Email tracking is used for transactional and marketing emails to monitor deliverability, measure engagement, and improve our communications with you.

3. Sources of Personal Information

We may collect Personal Information from:

• You (directly), when you create an account, complete a profile, list services, make bookings, message, or contact support;
• Other users (e.g., when they message you, submit a dispute, leave a review, or reference a booking);
• Service providers (e.g., payment processors, analytics providers, cloud hosting providers, customer support tools);
• Verification or compliance partners (if any, and if used);
• Public sources (e.g., to validate business information, where permitted by law); and
• Data aggregators and data brokers (where permitted by law, for business verification or fraud prevention purposes).

4. How We Use Personal Information

We may use Personal Information for the following purposes:

4.1 Provide and Operate the Platform

• Create and manage accounts
• Enable listings, browsing, booking requests, confirmations, communications, and customer support
• Facilitate transactions and operational workflows

4.2 Process Payments and Transaction Administration

• Process payments, refunds, and chargebacks through payment processors
• Maintain records of transactions and booking history
• Detect and prevent fraud and unauthorized transactions

4.3 Safety, Security, Fraud Prevention, and Platform Integrity

• Monitor, investigate, and prevent violations of our Terms of Service and policies
• Detect and prevent fraud, abuse, suspicious activity, and security incidents
• Enforce anti-circumvention and fee integrity policies
• Protect the rights, safety, and property of VenueSSS, users, and third parties
• Investigate and enforce anti-circumvention provisions, including monitoring communications and transaction patterns for potential off-platform transactions with Introduced Parties (Terms Sections 9 and Appendix B), consistent with applicable privacy and electronic communications laws
• Monitor compliance with Platform Fee obligations and confidentiality requirements
• Calculate and enforce liquidated damages for Terms violations

4.4 Personalization and Improvement

• Personalize content and recommendations
• Analyze usage trends and improve Platform functionality, performance, and user experience
• Develop and maintain new features

4.5 Communications and Marketing

• Send transactional messages (e.g., confirmations, receipts, security alerts)
• Respond to inquiries and support requests
• Send marketing communications where permitted (you may opt out as described below)

4.6 Legal, Compliance, and Business Purposes

• Comply with applicable law, respond to legal process, law enforcement requests, and regulatory inquiries, and cooperate with government authorities where required or permitted by law Pursue corporate transactions (including mergers, acquisitions, asset sales, financing, or acquisition-related diligence) Enforce Terms of Service, including anti-circumvention provisions, payment obligations, cancellation policies, and liquidated damages Process and resolve disputes, chargebacks, refunds, and damage claims Monitor and investigate potential violations of Sections 9 and Appendix B of the Terms, including by reviewing booking patterns, communication records, and transaction data for evidence of off-platform fee avoidance. By using the Platform, you expressly consent to such monitoring of your communications and transaction data for these enforcement purposes Maintain records necessary to calculate and enforce liquidated damages under Section 9.5 of the Terms

4.7 Platform Data and Business Intelligence

• Generate, own, and use Platform Data (as defined in the Terms of Service Section 12.3), including aggregated, de-identified, and anonymized data derived from your use of the Platform
• Create benchmarks, market reports, analytics products, and industry insights
• Train and improve algorithms, recommendation systems, search rankings, and machine learning models
• License or commercialize aggregated and de-identified data products, provided such data cannot reasonably be re-identified
• Develop new products and services using Platform Data You acknowledge that VenueSSS owns all Platform Data (aggregated, de-identified, and anonymized data) as described in Section 12.3 of the Terms of Service, which constitutes VenueSSS's proprietary business information and trade secrets. This ownership does not extend to your Personal Information in its identifiable form, which remains subject to your privacy rights under applicable law.

4.8 Email Engagement and Delivery

• Monitor email deliverability and ensure transactional emails reach recipients
• Track email open rates and engagement metrics to improve email performance
• Understand which content and links are most relevant to users
• Detect and prevent email fraud, abuse, or delivery issues
• Analyze email effectiveness to optimize future communications

4.9 Referral Program Administration

• If you participate in our referral program or are referred to the Platform:
• Attribute referrals to referrers and track referral performance
• Process referral rewards, incentives, or payouts (where applicable)
• Analyze referral program effectiveness
• Detect and prevent referral fraud or abuse

5. How We Disclose Personal Information

• We may disclose Personal Information as follows:

5.1 To Other Users (Core Marketplace Function)

• If you are a Customer, we may share certain information with Providers to facilitate bookings (e.g., name, contact details as needed, booking details, and communications).
• If you are a Provider, we may display or share certain profile and listing information with Customers (e.g., business name, listing details, availability, policies, reviews).

5.2 To Service Providers and Vendors

• We may disclose Personal Information to vendors that perform services on our behalf, such as:
• Payment processing
• Hosting and cloud services
• Analytics and performance monitoring
• Customer support and communications tools
• Email/SMS delivery
• Fraud prevention and security tools These vendors are contractually authorized to use Personal Information only as necessary to provide services to us, except where they process data independently under their own legal basis (e.g., payment processors, fraud prevention services operating under legal obligations).

5.3 To Payment Processors

• Payment processing is performed entirely by independent third-party payment processors. Payment processors collect, store, process, transmit, and handle payment card information, bank account information, and related financial data directly. VenueSSS has no control over, no access to, and no responsibility for payment processors' collection, use, storage, security, disclosure, retention, or protection of payment information. VenueSSS may receive limited payment-related information from payment processors, such as: (i) transaction confirmation status; (ii) partial payment card information (e.g., last four digits, card brand, expiration month/year); (iii) billing address; (iv) payment method type; and (v) transaction history and status. VenueSSS does not receive, store, or have access to full payment card numbers, CVV/CVC codes, or complete bank account credentials.

Payment processors operate as independent third parties under their own terms of service, privacy policies, security standards, and legal obligations. VenueSSS makes no representations or warranties regarding payment processors' data practices, security measures, compliance with applicable law, or use of cookies, tracking technologies, or similar data collection mechanisms. To the extent permitted by applicable law, VenueSSS is not responsible or liable for: (a) payment processors' collection, use, disclosure, or retention of payment information; (b) payment processor data breaches, security incidents, or unauthorized access; (c) payment processor failures, errors, delays, or non-compliance; (d) payment processors' responses to legal process or disclosure to third parties; (e) payment processors' use of cookies, tracking technologies, or similar data collection mechanisms; or (f) any other acts or omissions by payment processors in handling your payment information. Your use of payment features is subject to the payment processor's terms of service and privacy policy, which are incorporated by reference into the Terms of Service Section 6.3 and Appendix A. You acknowledge that you have reviewed and agree to be bound by the payment processor's terms and privacy policy. VenueSSS acts solely as an intermediary for payment processing and is not responsible for the payment processor's data handling practices, including their use of cookies, tracking technologies, or similar data collection mechanisms. VenueSSS has no control over and is not responsible for payment processors' use of cookies, tracking technologies, data practices, or security measures. For complete payment-related disclaimers and limitations of liability permitted under applicable law, see Terms of Service Appendix A, Section 7.

5.4 For Legal Reasons and Protection

We may disclose Personal Information where we determine disclosure is necessary or appropriate to comply with: lawful requests by public authorities (including to meet national security or law enforcement requirements);

• Comply with regulatory investigations, audits, or governmental inquiries;
• Protect the rights, property, safety, and security of VenueSSS, our users, or others, including detecting, preventing, or addressing fraud, security incidents, or illegal activity;
• Investigate, prevent, or take action regarding suspected or actual violations of the Terms of Service, including anti-circumvention provisions under Section 9 and Appendix B, payment obligations, and confidentiality requirements;
• Establish, exercise, or defend legal claims, including in litigation, arbitration, or other dispute resolution proceedings;
• Enforce the Terms of Service, including collecting amounts owed, enforcing cancellation policies, and pursuing liquidated damages;
• Respond to claims that content violates third-party rights; or
• Protect against legal liability or comply with legal obligations.

5.5 Business Transfers

If VenueSSS is involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, Personal Information may be disclosed as part of that transaction (subject to standard confidentiality protections where appropriate).

5.6 With Professional Advisors and Service Providers

VenueSSS reserves the right to disclose any information (including Personal Information, Platform Data, communications, and transaction records) where we determine in good faith that disclosure is appropriate for any of the purposes listed above. We may share Personal Information with professional advisors and service providers in connection with our compliance, risk management, disputes, corporate transactions, and business operations, including:

• Attorneys, legal counsel, and law firms (for legal advice, representation, compliance, dispute resolution, and litigation);
• Accountants, auditors, and tax advisors (for financial audits, tax compliance, and financial reporting);
• Insurers, insurance brokers, and risk management advisors (for insurance coverage, claims handling, and risk assessment);
• Business consultants, advisors, and analysts (for strategic planning, operational improvement, and business intelligence);
• Corporate transaction advisors (for mergers, acquisitions, financings, divestitures, and due diligence);
• Directors, officers, board members, and advisory board members (for governance, strategic oversight, and fiduciary duties);
• Forensic investigators and fraud prevention specialists (for investigations, fraud detection, and security incident response); and
• Other professional service providers necessary for VenueSSS's business operations, legal compliance, and risk management. These professional advisors and service providers may receive Personal Information subject to confidentiality obligations under professional ethics rules, engagement agreements, or applicable

law. VenueSSS implements contractual safeguards with service providers as required by applicable law. However, VenueSSS is not responsible for these parties' independent use or disclosure of information beyond the scope of their engagement with VenueSSS or where they process information for their own independent purposes.

5.7 Aggregated, De-Identified, and Anonymized Data

We may disclose, license, sell, or otherwise commercialize aggregated, de-identified, or anonymized data that does not identify you personally and is not reasonably capable of being associated with you. Such data is not considered Personal Information under this Privacy Policy. We may disclose aggregated, de-identified, or anonymized data to:

• Business partners, customers, and clients for benchmarking, analytics, and market intelligence purposes;
• Researchers, academics, and industry organizations for research and analysis;
• Advertisers and marketing partners for campaign measurement and audience insights;
• Data analytics companies and business intelligence providers;
• Any other third parties for any lawful business purpose. VenueSSS owns all aggregated, de-identified, and anonymized data derived from the Platform and user activity, including data derived from cookies and similar technologies, as described in Section 12.3 of the Terms of Service. De-identified data means information that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, and for which VenueSSS has implemented technical safeguards and business processes that prohibit re-identification. We make no commitments regarding whether aggregated or de-identified data can or cannot be re-identified by third parties who receive such data from VenueSSS. You acknowledge and agree that VenueSSS's disclosure of aggregated, de-identified, or anonymized data that meets applicable legal standards for de-identification is not subject to opt-out rights, deletion rights, or other privacy rights under applicable law.

6. Payment Processing Note

Payments are processed by independent third-party payment processors (the "Payment Processor(s)"). Payment processors directly collect, store, process, and transmit your payment information under their own terms of service, privacy policies, and security standards. VenueSSS receives limited payment information (such as payment confirmation, last four digits of card numbers, card type, and billing address) but does not receive or store full payment card numbers, CVV codes, or bank account credentials. VenueSSS does not have access to your complete payment information and does not control payment processors' data handling practices.

Payment processors' handling of your payment information is governed by their own privacy policies and terms of service, which are incorporated by reference in the Terms of Service. You acknowledge and agree that:

• Payment processors operate independently and VenueSSS has no control over their data practices, security measures, or compliance;
• VenueSSS makes no representations or warranties regarding payment processors' protection of payment information or compliance with applicable law;
• VenueSSS is not responsible or liable for payment processor data breaches, security incidents, unauthorized access, failures, errors, delays, or non-compliance;
• Your use of payment features is subject to the payment processor's terms and privacy policy, and you are solely responsible for reviewing and agreeing to those terms;
• VenueSSS does not guarantee payment processing and disclaims liability for payment reversals, disputes, chargebacks, processing delays, or payment processor failures to the maximum extent permitted by applicable law (see Terms of Service Appendix A, Section 7); and
• Payment processor failures, errors, breaches, or delays are governed by the payment processor's own terms, policies, and legal obligations, not by this Privacy Policy or the Terms of Service. For complete payment processing terms, disclaimers, and limitations of liability, see Terms of Service Section 6.3 and Appendix A (Payments Terms). Cryptocurrency and Alternative Payment Methods: If VenueSSS enables cryptocurrency or alternative payment methods in the future, such payment processing will be performed by independent third-party payment processors or wallet providers operating under their own terms, privacy policies, and blockchain protocols. VenueSSS will not have access to or control over private keys, wallet credentials, or on-chain transaction data beyond what is necessary to confirm payment status. All disclaimers and limitations of liability in this Section 6 and Terms of Service Appendix A apply fully to cryptocurrency and alternative payment methods. You acknowledge that blockchain transactions are typically irreversible, pseudonymous, and publicly visible on distributed ledgers, and that VenueSSS has no control over or responsibility for blockchain protocols, network fees, transaction speeds, wallet security, or cryptocurrency exchange rate volatility.

7. Cookies, Analytics, and Targeted Advertising

This Section 7 provides a summary of key cookie practices, including cookie types, purposes, retention periods, and available opt-out mechanisms. We and our service providers may use cookies and similar technologies (including web beacons, pixels, local storage, and similar tracking technologies) to:

• Keep you logged in and remember preferences
• Enable core functionality
• Understand usage and improve the Platform
• Help measure marketing effectiveness

7.1 Analytics

We may use analytics services such as Metricool to understand how users interact with the Platform. These analytics providers may use cookies and similar technologies to collect information about your use of the Platform. Analytics providers operate under their own privacy policies and terms of service. VenueSSS is not responsible or liable for analytics providers' data practices, security incidents, breaches, failures, or non-compliance, as described in Sections 1.1, 5.2, 5.3, and 9 of this Privacy Policy.

7.2 Targeted Advertising / Cross-Context Behavioral Advertising (If Used)

We may work with advertising partners to deliver ads and measure performance. Depending on configuration, this may involve “targeted advertising” or “sharing” for cross-context behavioral advertising under certain laws. Opt-Outs: You may be able to opt out of targeted advertising and related data sharing through:

• Browser/device controls and industry opt-out tools
• Certain universal opt-out signals, where legally required (see Section 10)

7.3 Email Link Tracking

Links in emails sent by VenueSSS may be rewritten or redirected through third-party servers (including our email service provider) to track email engagement, measure link click rates, and improve email deliverability. When you click a link in an email from VenueSSS, your click may

be logged before you are redirected to the final destination. This tracking helps us understand email performance and improve our communications with you. Email link tracking data is collected automatically and is used for the purposes described in Section 4.8 (Email Engagement and Delivery). We do not use email link tracking for cross-context behavioral advertising or "selling" your Personal Information as those terms are defined under applicable privacy laws.

8. Data Retention

We retain Personal Information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, enforce the Terms of Service, resolve disputes, prevent fraud, maintain Platform integrity, and protect our legitimate business interests. Retention periods vary based on the nature of the information, the purposes for which it is processed, and applicable legal requirements. Legal Basis for Retention: We retain Personal Information based on: (i) contractual necessity (to perform our obligations under the Terms of Service and maintain transaction records); (ii) legal obligations (to comply with tax, financial reporting, and regulatory requirements); (iii) legitimate interests (to enforce Terms, prevent fraud, resolve disputes, maintain Platform integrity, and protect our legal rights); and (iv) consent where applicable. Our legitimate interests in retention include business continuity, legal defense, regulatory compliance, and protection of intellectual property rights in Platform Data. The following are general retention guidelines only. We may retain information for longer or shorter periods where necessary or appropriate in our sole discretion for legitimate business purposes, legal compliance, regulatory requirements, dispute resolution, Terms enforcement, or risk management:

• Transaction and Booking Records: Retained for periods required by applicable law (typically 7 years for tax, financial, and audit purposes under 26 U.S.C. 6001 and similar state requirements) and as necessary to enforce the Terms of Service, including for at least eighteen (18) months after account termination or deactivation as provided in Terms Section 9.1, and longer where necessary to investigate, prove, or enforce violations of Section 9 (Anti-Circumvention) or

Appendix B (Provider Anti-Circumvention & Confidentiality Addendum), including evidence of

off-platform transactions, communications with Introduced Parties, and Platform Fee avoidance. Where litigation, arbitration, regulatory investigations, or legal holds are pending or reasonably anticipated, retention continues until resolution plus applicable statute of limitations periods.

• Legal, Regulatory, and Dispute Resolution: Retained until the expiration of applicable statutes of limitations (which may be up to 10 years or longer for certain claims), and as necessary to

establish, exercise, or defend legal claims, respond to legal process, comply with regulatory investigations, or satisfy legal hold obligations. Retention periods may be extended indefinitely where litigation, investigations, audits, or legal holds are pending or reasonably anticipated.

• Fraud Prevention, Security, and Platform Integrity: Retained for as long as reasonably necessary to detect, investigate, and prevent fraud, security threats, and Terms violations, and to maintain Platform integrity. Retention periods vary based on the nature of the risk, severity of violations, and ongoing threat assessment. For serious violations, repeat offenders, or ongoing fraud patterns, retention may be indefinite to prevent future fraud or abuse.
• Platform Data and Business Intelligence: Retained indefinitely. Platform Data (as defined in Terms Section 12.3) constitutes VenueSSS's proprietary business information and trade secrets. VenueSSS retains perpetual rights to Platform Data, including all aggregated, de-identified, and anonymized data derived from your use of the Platform, regardless of account status or termination.
• User Content and Communications: Retained as long as necessary for Platform operation, dispute resolution, Terms enforcement, legal compliance, and as required to maintain marketplace integrity. User Content may be retained indefinitely where incorporated into Platform Data or where necessary for VenueSSS's legitimate business interests.
• Account Information: Retained during the period your account is active and for reasonable periods thereafter as necessary for the purposes described above. Account deletion does not delete Platform Data, transaction records subject to legal retention requirements, or information: (i) necessary for ongoing investigations; (ii) necessary for ongoing or reasonably anticipated litigation, arbitration, investigation, audit, or dispute resolution; (iii) subject to legal hold; (iv) necessary to enforce the Terms of Service or establish, exercise, or defend legal claims; (v) necessary for fraud prevention, security, or Platform integrity; (vi) necessary to calculate or collect amounts owed to VenueSSS (including Platform Fees, liquidated damages, penalties, refunds, or chargebacks); or (vii) where deletion would undermine VenueSSS's legitimate business interests. No Deletion of Platform Data: Deletion of your account or exercise of deletion rights does not require deletion of: (a) Platform Data owned by VenueSSS under Terms Section 12.3; (b) aggregated, de-identified, or anonymized data; (c) data retained for the purposes described above; or (d) data incorporated into VenueSSS's systems, analytics, algorithms, or business intelligence. Survival: VenueSSS's data retention rights, Platform Data ownership, and the provisions of this Section 8 survive termination of your account, termination of the Terms of Service, and exercise of any deletion or privacy rights. The data retention practices and exceptions described in this

Section 8 and Section 12.3 of the Terms of Service shall continue to apply following any such termination or exercise of rights. Effect of Account Termination on Privacy Requests: Termination of your account (whether by you or by VenueSSS) may limit or eliminate our ability to fulfill certain privacy requests, including access requests, correction requests, and portability requests, where fulfillment would require maintaining access to systems or data that has been archived, deleted, or made inaccessible consistent with our retention policies and technical limitations. VenueSSS is not obligated to maintain systems access or restore archived data to fulfill privacy requests following account termination.

9. Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration, and destruction. The specific safeguards we implement vary based on the sensitivity of the data, technical feasibility, cost, and business requirements, and may include measures such as encryption, access controls, authentication requirements, monitoring and logging, vendor security requirements, security assessments, and other measures we deem appropriate in our sole discretion. No Security Guarantee: However, no security system is completely secure, and no method of transmission over the Internet or method of electronic storage is 100% secure. Our security measures are implemented on a commercially reasonable efforts basis only and are subject to technical limitations, evolving threats, and resource constraints. Limitations and Disclaimers: VenueSSS is not responsible or liable for: (a) security incidents, data breaches, or unauthorized access resulting from circumstances beyond our reasonable control, including third-party attacks, user conduct (such as weak passwords, credential sharing, or phishing), software vulnerabilities, zero-day exploits, or advanced persistent threats; (b) security failures, breaches, or incidents at third-party service providers (including payment processors, hosting providers, verification services, analytics providers, and other vendors), even where we have required security measures contractually; (c) interception of data in transmission over networks we do not control; (d) unauthorized access resulting from user compromise of credentials or failure to maintain security of devices or accounts; or (e) delays in detecting or responding to security incidents. User Responsibility: You are responsible for maintaining the security of your account credentials, devices, and access methods.

Third-Party Security: Third-party service providers (including payment processors, verification services, hosting providers, and analytics providers) implement their own security measures under their own legal obligations and industry standards. VenueSSS makes no representations or warranties regarding third-party security practices or compliance with security standards (including PCI-DSS, SOC 2, ISO 27001, or other frameworks). You acknowledge and agree that VenueSSS is not responsible for third-party security failures, breaches, or incidents. No Security Advisory Services: Nothing in this Privacy Policy constitutes security advice, recommendations, or guarantees. VenueSSS does not warrant that its security measures are sufficient for your particular security requirements, risk tolerance, or regulatory obligations. Complete Limitations of Liability: For complete disclaimers and limitations of liability related to security and data protection, see Section 1.1 of this Privacy Policy and Sections 15 and 16 of the Terms of Service, which are incorporated herein by reference. Data Breach Notification: In the event of a data breach, VenueSSS will provide notifications only to the extent and in the manner required by applicable law. VenueSSS reserves the right to determine, in its sole discretion and in consultation with legal counsel and forensic experts: (i) whether breach notifications beyond what is legally required, and any notifications provided shall not constitute an admission of liability, fault, or breach of any obligation.

9.1 Automated Decision-Making and Profiling

We may use automated systems, algorithms, machine learning models, and artificial intelligence to make decisions that affect your use of the Platform and your experience as a user. Automated decision-making may be used for purposes including:

• Search result rankings and listing visibility determinations;
• Personalized recommendations and content customization;
• Fraud detection, risk assessment, and security threat identification;
• Account verification, identity authentication, and trust scoring;
• Terms of Service violation detection and enforcement;
• Anti-circumvention investigation and detection of off-platform transactions;
• Payment processing decisions, including authorization, decline, and chargeback liability allocation;
• Pricing optimization and dynamic pricing (where applicable);
• Training and improving artificial intelligence models, large language models (LLMs), machine learning algorithms, and recommendation systems;
• Spam detection and content moderation;
• Customer support routing and prioritization; and
• Other Platform functionality, optimization, and integrity purposes.

No Guarantee of Accuracy: Automated decision-making systems are not perfect and may produce inaccurate, or evolving user behavior patterns. Limited Explanation Rights: You may have limited rights to obtain information about automated decision-making logic under certain privacy laws. However, VenueSSS may decline to provide detailed explanations where doing so would: (i) reveal trade secrets, proprietary algorithms, or confidential business methods; (ii) compromise Platform security, fraud prevention, or Terms enforcement; (iii) enable gaming or manipulation of Platform systems; or (iv) not be required by applicable law. Any explanations provided will be general in nature and will not disclose sensitive technical details, scoring methodologies, or fraud detection techniques. Human Review: We may (but are not obligated to) provide human review of certain automated decisions where required by applicable law or where we determine in our sole discretion that human review is appropriate. However, human reviewers may rely on automated systems' outputs and recommendations, and human review does not guarantee different outcomes. Profiling for Anti-Circumvention: We specifically reserve the right to use profiling, behavioral analysis, and pattern recognition to detect violations of Terms Section 9 (Anti-Circumvention) and Appendix B, including analyzing booking patterns, communication content, transaction histories, and user behavior to identify off-platform fee avoidance and circumvention attempts. You may not opt out of such profiling, as it is necessary for Terms enforcement and marketplace integrity. Subject to Disclaimers: All automated decision-making and profiling is subject to the disclaimers and limitations of liability in Section 1.1 of this Privacy Policy and the Terms of Service.

10. Your Privacy Choices and Rights

Depending on where you live, you may have rights such as:

• Access to Personal Information
• Correction of inaccurate Personal Information
• Deletion of Personal Information
• Data portability
• Opt-out of certain processing (e.g., targeted advertising, sale/sharing, certain profiling)
• Appeal of certain decisions (in some jurisdictions)

10.1 How to Submit Requests

You can submit a privacy request by:

• Emailing: legal@venuesss.co Identity Verification: We will verify your identity before fulfilling requests using methods we deem appropriate in our sole discretion based on the nature of the request, the sensitivity of the information, fraud risk, technical capabilities, and legal requirements. Verification methods may include, without limitation: (i) matching information you provide against information in our records; (ii) requiring authentication through your account login; (iii) requiring government-issued identification documents. We may use third-party verification services to confirm your identity. VenueSSS is not responsible for verification service providers' data practices, security measures, privacy compliance, or failures. Verification service providers operate as independent third parties under their own legal obligations. Verification standards are determined by VenueSSS using reasonable methods consistent with applicable law. What constitutes "reasonable" verification depends on factors including the sensitivity of the requested information, fraud indicators, technical feasibility, and the potential risks to you and VenueSSS if an unauthorized person gains access to your information. VenueSSS may apply heightened verification requirements for deletion requests, access requests involving sensitive Personal Information, and requests that present elevated fraud risk. We may deny requests if we cannot verify your identity using reasonable methods. Our determination of whether verification is sufficient shall be made in good faith consistent with applicable law and is subject to review by regulatory authorities as provided by law. Processing Times: We will respond to verified requests within forty-five (45) days of receipt. We may extend this period by an additional forty-five (45) days where reasonably necessary, considering the complexity and number of requests. We will inform you of any extension within the initial 45-day period, along with the reason for the extension. Extensions may be necessary where: (i) requests are complex, voluminous, or require extensive search and compilation; (ii) verification is delayed or requires additional information from you; (iii) we are experiencing high request volume; (iv) technical limitations delay fulfillment; (v) legal review is necessary; or (vi) other circumstances make extension reasonably necessary. Our determination of whether an extension is necessary shall be made consistent with applicable law. Security Measures: We implement reasonable administrative, technical, and physical security

measures appropriate to the risk, designed to protect Personal Information from unauthorized access, destruction, use, modification, or disclosure. The specific measures we implement vary based on the sensitivity of data, the nature and scope of our processing activities, current state of technology, implementation costs, and the risks presented by the processing. Such measures may include encryption, access controls, authentication procedures, monitoring, vendor security requirements, and other safeguards appropriate to protect Personal Information. Fees: We do not charge fees for requests unless: (i) requests are manifestly unfounded, excessive, or repetitive, in which case we may charge reasonable copying and administrative fees to the extent permitted by applicable law. Our determination of whether a request is excessive or repetitive shall be made in good faith consistent with applicable law.

10.1A Limitations on Rights

Your rights are subject to exceptions under applicable law. We may deny or limit requests where:

• We cannot verify your identity
• The request is manifestly unfounded, excessive, or repetitive
• Disclosure would adversely affect others' rights
• The information is subject to legal privilege, legal process, or legal hold
• Retention is necessary for legal compliance, fraud prevention, security, or enforcing Terms of Service
• The information constitutes Platform Data owned by VenueSSS (Section 12.3 of Terms)
• Deletion would undermine ongoing investigations, dispute resolution, or enforcement actions For Providers: Deletion requests cannot eliminate information necessary for anti-circumvention enforcement during the 6-month post-termination period (Terms Section 9.1) or information necessary to enforce payment obligations, refund obligations, or cancellation penalties. VenueSSS's determination of whether a limitation or exception applies shall be made in good faith consistent with applicable law. You may appeal denials as provided in Section 10.2 and may also have the right to submit complaints to regulatory authorities as provided by applicable law. We may use third-party verification services and may request government-issued identification, account information, or other information reasonably necessary to verify your identity and protect against fraudulent requests. We may deny requests if we cannot verify your identity using

reasonable means. Verification requirements may be more stringent for deletion requests and requests involving sensitive Personal Information.

10.2 Appeals

If we deny your request in whole or in part, and you reside in a jurisdiction that provides a right to appeal, you may appeal by contacting us at legal@venuesss.co within 30 days of receiving our denial. Your appeal must include: (i) your name and contact information; (ii) description of the request that was denied; (iii) the grounds for your appeal; and (iv) any supporting documentation or information you believe is relevant. Where you have the right to appeal under applicable law, we will respond to your appeal within forty-five (45) days of receipt, or within such other timeframe as required by applicable law. We may extend this period where reasonably necessary, considering the complexity of the appeal. We will inform you of any extension and the reason for it. Our response may be delayed where: (i) the appeal requires legal review; (ii) we require additional information from you; (iii) the appeal involves complex factual or legal issues; (iv) we are experiencing high appeal volume; or (v) other circumstances make delay reasonably necessary consistent with applicable law. Our decision on appeal is subject to review by regulatory authorities and courts as provided by applicable law. Nothing in this Section 10.2 limits VenueSSS's right to assert any defense, exception, or limitation available under applicable law in any subsequent proceeding, nor does it limit your right to file complaints with regulatory authorities or pursue other remedies available under applicable law.

10.3 Marketing Opt-Out

You may opt out of marketing emails by:

• Clicking "unsubscribe" in any marketing email
• Updating your account communication preferences
• Contacting us at legal@venuesss.co Transactional and Operational Communications: Even if you opt out of marketing, you will still receive transactional, operational, and legally required communications, including:
• Booking confirmations, cancellations, and modifications
• Payment receipts, refund notifications, and billing alerts
• Security alerts and account notifications
• Terms of Service updates and policy changes
• Dispute resolution and claims communications
• Legal notices, subpoenas, and regulatory communications
• Anti-circumvention investigation notices
• Platform integrity and enforcement notices These communications are necessary for the performance of our contract with you, our legitimate business interests, and legal compliance. While you maintain an account or have pending bookings, payment obligations, disputes, or other ongoing obligations under the Terms of Service, you will continue to receive these communications as they are essential to providing the services you have requested and fulfilling our contractual and legal obligations. To stop receiving transactional and operational communications, you must close your account, satisfy all outstanding obligations under the Terms of Service, and wait until all retention periods under Section 8 have expired. Even after account closure, you may continue to receive communications necessary for legal compliance, dispute resolution, collections, and Terms enforcement during applicable retention periods.

11. “Sale,” “Sharing,” and Targeted Advertising

VenueSSS does not sell Personal Information for monetary payment. However, to the extent we use cookies, pixels, or advertising technologies that disclose Personal Information to third-party advertising partners for targeted advertising purposes, such disclosures may constitute a "sale" or "sharing" under some state privacy laws. You may opt out of:

• Targeted advertising
• "Sale" of Personal Information (as defined by applicable law)
• "Sharing" for cross-context behavioral advertising (where applicable) Opt-out methods:
• Where required by law, honoring certain universal opt-out preference signals (see Section 11.2)
• Contacting us at legal@venuesss.co

Limitations on Opt-Out Rights: Your opt-out rights do not limit or restrict:

• Disclosures to service providers acting on VenueSSS's behalf for business purposes and Platform operation;
• Disclosures to Customers as necessary to facilitate bookings you request or provide;
• Disclosure of Platform Data owned by VenueSSS under Section 12.3 of the Terms of Service, including aggregated, de-identified, and anonymized data;
• Use of information for anti-circumvention investigation and enforcement under Terms Section 9 and Appendix B (Provider Anti-Circumvention & Confidentiality Addendum);
• Disclosures required by law, legal process, court orders, or governmental requests;
• Disclosures necessary to enforce the Terms of Service, establish or defend legal claims, or protect rights, safety, and property;
• Disclosures in connection with business transfers, mergers, acquisitions, or sales of assets; or
• Other disclosures that do not constitute "sales" or "sharing" under applicable law. Provider-Specific Limitations: If you are a Provider, your opt-out rights are additionally limited by the following: (a) Opt-out does not limit VenueSSS's retention and use of Platform Data as described in Section

12.3 of the Terms, which constitutes VenueSSS's proprietary business information and trade

secrets; (b) Opt-out does not limit sharing information necessary for payment processing, fraud prevention, chargeback handling, and Platform operation; (c) Opt-out does not limit disclosing information necessary for detecting, investigating, and preventing anti-circumvention violations and Platform Fee avoidance; (e) Opt-out does not limit disclosures as required by law or to enforce the Terms of Service; and (f) Opt-out does not limit retention or use of information as described in Section 8 (Data Retention). Your opt-out is subject to verification of your identity as described in Section 10.1 and may take up to fifteen (15) business days to process fully across all systems, partners, and platforms.

11.1 Global Privacy Control / Universal Opt-Out Signals

Where specifically required by applicable law, we will process certain universal opt-out preference signals (such as Global Privacy Control, or "GPC") as requests to opt out of sale/sharing/targeted advertising, subject to the following conditions and limitations:

• Where required by applicable state law, we will process recognized universal opt-out preference signals (such as Global Privacy Control) as requests to opt out of the sale or sharing of Personal Information, subject to the following: (i) the signal must be sent in a format we can recognize; (ii) we may require account authentication to apply preferences across multiple devices or to link the signal to your account; and (iii) the opt-out will be applied consistent with the scope and limitations described in Section 11.
• We may require account authentication to apply opt-out preferences across multiple devices or sessions, or to honor opt-outs for account-specific processing. Opt-out signals apply only to the specific browser or device from which they are sent unless you authenticate your account and explicitly request cross-device application.
• Universal opt-out signals do not opt you out of: (i) transactional, operational, or legally required communications as described in Section 10.3; (ii) data collection and use necessary for Platform functionality, security, fraud prevention, or Terms enforcement; (iii) retention and use of Platform Data under Section 12.3 of the Terms; (iv) disclosures that do not constitute "sale" or "sharing" under applicable law (such as disclosures to service providers, disclosures necessary for payment processing, and disclosures to complete transactions you request); or (v) any processing permitted under applicable law.
• We may require additional verification before processing universal opt-out signals where: (i) the signal conflicts with your account preferences; (ii) we detect indicators of fraud or manipulation; (iii) the signal is technically unreliable or ambiguous; or (iv) verification is necessary to prevent unauthorized opt-outs.
• We will process universal opt-out signals within fifteen (15) business days of receipt. The opt-out will apply prospectively from the date of processing. We are responsible for honoring the opt-out for our own processing activities. Third-party partners are responsible for their own compliance with opt-out signals as required by applicable law.
• Our determination of whether a universal opt-out signal meets the requirements for processing shall be made in good faith based on technical feasibility, legal requirements, and industry standards, consistent with applicable law.
• For more control and certainty over your opt-out preferences, we recommend using the opt-out methods described in Section 11.1 in addition to or instead of relying on universal opt-out signals.

Where applicable law does not require honoring universal opt-out signals, we reserve the right (but have no obligation) to honor such signals in our sole discretion.

11.2 Sensitive Personal Information

We process sensitive Personal Information only as permitted by applicable law. We do not use or disclose sensitive Personal Information for purposes of inferring characteristics about you, except as necessary for Platform operation, fraud prevention, security, Terms enforcement, and other purposes described in Section 4 or as permitted by applicable law. Where required by law, you may limit use of sensitive Personal Information using the methods described in Section 10.1.

11.3 Non-Discrimination

We will not discriminate against you for exercising privacy rights (e.g., by denying services, charging different prices, or providing a different level of quality), except as permitted by law.

11.4 Financial Incentives and Differential Pricing

We do not currently offer financial incentive programs, loyalty programs, rewards programs, price differences, or service level differences in exchange for the collection, retention, sale, or sharing of Personal Information, as those terms are defined under applicable state privacy laws. If we offer any such programs in the future, we will provide separate notice describing: (i) the material terms of the program; (ii) how to opt in; (iii) how to opt out; and (iv) a good faith estimate of the value of your Personal Information that forms the basis for offering the financial incentive or price or service difference (to the extent we can reasonably calculate such value), as required by applicable law. We reserve the right to offer different prices, rates, levels, or quality of goods or services to you if the difference is: (i) reasonably related to the value provided to us by your Personal Information; (ii) permitted by applicable law; or (iii) not based on your exercise of privacy rights. Nothing in this Section limits VenueSSS's right to charge different Platform Fees, offer promotions, or provide different service levels based on legitimate business criteria unrelated to the exercise of privacy rights.

12. Children’s Privacy

The Platform is not intended for, and may not be used by, individuals under 18 years of age (or the age of majority in your jurisdiction, whichever is greater). We do not knowingly collect Personal Information from individuals under 18 years of age. By using the Platform, you represent and warrant that you are at least 18 years old (or the age of majority in your jurisdiction, whichever is greater) and have the legal capacity to enter into

binding contracts. See Terms of Service Section 2.1 (Eligibility Requirements). If we discover that an individual under 18 has created an account or provided Personal Information, we will promptly delete such information unless retention is required for legal compliance, or necessary to establish, exercise, or defend legal claims. If you believe an individual under 18 has provided Personal Information to us, contact us immediately at legal@venuesss.co. Parental Responsibility: Parents and guardians are solely responsible for monitoring and supervising minors' internet use and access to devices. VenueSSS is not responsible or liable for minors' unauthorized use of the Platform, minors' unauthorized creation of accounts, or minors' provision of false age information, subject to the limitations of liability in Section 1.1 of this Privacy Policy and Sections 15 and 16 of the Terms of Service. No Services for Minors: VenueSSS does not offer any services directed to minors and does not knowingly market to or solicit Personal Information from individuals under 18 years of age.

13. External Links and Third-Party Websites

The Platform may contain links to external websites, services, or applications operated by third parties, including social media platforms (e.g., Facebook, Instagram, X, LinkedIn, TikTok), payment processors, service providers, and other third parties. These external links are provided for your convenience only. VenueSSS does not control, endorse, or assume responsibility for the privacy practices, data collection, security measures, or content of third-party websites or services. When you click on external links, you may be redirected to third-party websites that operate under their own privacy policies and terms of service. VenueSSS is not responsible for: (a) how third parties collect, use, disclose, or protect your Personal Information; (b) third-party data breaches or security incidents; (c) third-party use of cookies, tracking technologies, or similar data collection mechanisms; or (d) third-party compliance with applicable privacy laws. We encourage you to review the privacy policies and terms of service of any third-party websites you visit. Your interactions with third-party websites are governed by their privacy policies and terms, not this Privacy Policy. This Section 13 does not limit or modify the disclaimers and limitations of liability in Section 1.1 of this Privacy Policy or Sections 15 and 16 of the Terms of Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date indicates when it was most recently revised. If changes are material, we may provide additional notice as appropriate. Changes to this Privacy Policy do not modify or limit the disclaimers, releases, limitations of liability, indemnification obligations, or dispute resolution provisions in the Terms of Service, which remain in full force and effect.

15. Contact Us

If you have questions, requests, or complaints regarding this Privacy Policy, contact: VenueSSS, Inc. Attn: Privacy Address: 43 E Broad Oaks Drive, Houston, TX 77056 Email: legal@venuesss.co Phone: 832 244 3776