Processing Agreement and Security Policy TablePlay Including subprocessor list, technical and organisational measures, responsible disclosure and accessibility statement

TablePlay by Jimani Jimani B.V. Albert Plesmanweg 122, 4462 GC Goes Company Registration No. 91644453 - VAT NL865722729B01 support@tableplay.online

Version 1.0 Last updated: 10 July 2026

Legal review note This document has been drawn up for business use by TablePlay. Have the final publication, international application, current suppliers, technical set-up and country-specific rules reviewed periodically by legal counsel.

Table of Contents Part A - Processing Agreement Annex 1 - Subprocessors Annex 2 - Technical and Organisational Measures Part B - Security and Coordinated Vulnerability Disclosure Part C - Accessibility Statement

Processing Agreement and Security Policy TablePlay

Page 2 of 10

Part A - Processing Agreement Article 1 - Parties This processing agreement applies between the business customer of TablePlay as Controller and Jimani B.V., trading as TablePlay by Jimani, Albert Plesmanweg 122, 4462 GC Goes, Company Registration No. 91644453, as Processor. The Parties are jointly referred to as the Parties.

Article 2 - Applicability and formation This agreement applies to the extent that TablePlay processes personal data on the instructions of and for the benefit of the Customer and forms an integral part of the principal agreement. It is formed by electronic acceptance, signature or actual use of the Service. For processing activities for which TablePlay independently determines the purposes and means, TablePlay is controller and the Privacy Statement applies. In the event of a conflict regarding processing on behalf of the Customer, this Processing Agreement shall prevail over the General Terms and Conditions.

Article 3 - Subject matter, duration and nature TablePlay processes personal data for restaurant-related game, table, QR, score, leaderboard, dashboard and support functionalities. The processing continues for the duration of the principal agreement and for a limited period thereafter for deletion, return, back-up rotation, statutory obligations and legal protection. The processing may comprise collecting, recording, organising, structuring, storing, consulting, calculating, combining within the restaurant context, displaying, transmitting, restricting, deleting and anonymising.

Article 4 - Purposes • Linking QR codes to restaurant and table. • Starting and carrying out game sessions. • Processing temporary nicknames, game choices, answers, scores and results. • Facilitating table-versus-table games and temporary leaderboards. • Displaying restaurant-related statistics. • Preventing duplicate, fraudulent or technically invalid sessions. • Technical support, security, continuity and recovery. • Deletion or anonymisation after retention periods.

Article 5 - Categories of data subjects • Guests and players of the Customer. • Contact persons, users, employees and auxiliary persons of the Customer. • Persons appearing in a support request.

Article 6 - Categories of personal data • Temporary nickname, table number or unique table ID and restaurant or location ID. • Game session ID, selected game, game mode, answers, actions, score, result and ranking. • Date, time and temporary language setting. • Technical session, IP, browser and device data to the extent present in security logs.

Processing Agreement and Security Policy TablePlay

Page 3 of 10 • Name and business e-mail address of a contact person and content of support enquiries. • Other data entered within the agreed functionality. TablePlay is not intended for special categories of data, criminal, medical or biometric data or extensive directly identifiable guest profiles. The Customer shall not instruct such processing without prior written agreement.

Article 7 - Documented instructions The principal agreement, this Processing Agreement, customer portal settings and lawful support requests constitute instructions. TablePlay does not process data for other purposes, except for statutory obligations, its own security and legal protection purposes, or processing after adequate anonymisation. In the event of a suspected unlawful instruction, TablePlay shall inform the Customer, unless prohibited by law, and may suspend performance. Additional extensive instructions may be invoiced separately.

Article 8 - Obligations of the Client The Client warrants lawfulness, valid legal basis, information to Guests, lawful instructions, data minimisation, internal security and protection of login credentials. The Client is responsible for accuracy and quality, does not require real names from Guests and does not use Game Data for individual marketing or profiling without an independent legal basis. Security incidents and unlawful instructions shall be reported without delay.

Article 9 - Confidentiality Persons under the authority of TablePlay are granted access only to the extent necessary, are bound by confidentiality and process data only in accordance with instructions. This obligation shall remain in force after termination. Disclosure to third parties shall only take place on the basis of this agreement, the principal agreement or the law.

Article 10 - Security TablePlay shall implement appropriate technical and organisational measures, taking into account the state of the art, costs, nature, scope, context, purpose and risk. The measures are set out in Annex 2 and may be adjusted provided that the general level of protection is not materially reduced. No system can guarantee absolute security.

Article 11 - Data Breaches TablePlay shall inform the Client without undue delay after it has become aware of a breach of personal data processed on behalf of the Client. Where possible, the nature, systems, categories of data and data subjects, consequences, measures and contact information shall be provided. Information may be provided in phases. TablePlay shall investigate, contain, preserve relevant evidence and carry out remediation. The Client shall assess the statutory notification obligation and TablePlay shall provide reasonable support. A notification shall not constitute an acknowledgement of liability. Work performed as a result of circumstances within the responsibility of the Client may be carried out at reasonable cost.

Article 12 - Requests from Data Subjects Direct requests concerning the role of the Client shall in principle be forwarded. TablePlay shall respond independently only upon instruction, in its own role or in the event of a statutory obligation. TablePlay shall provide reasonable support with respect to access, rectification, erasure, restriction, portability and objection.

Data Processing Agreement and Security Policy TablePlay

Page 4 of 10

Because Guests do not have an Account, identification may be limited. Restaurant, table, date, time, nickname and game context may be required. Data shall not be provided if it is not sufficiently established that they relate to the requester.

Article 13 - Support with Compliance TablePlay shall provide reasonable support with security, data breach assessments, data protection impact assessments, prior consultation and necessary documentation. Extensive support beyond the standard service may be invoiced, unless it results from a failure on the part of TablePlay.

Article 14 - Sub-processors The Client grants general authorisation for the sub-processors listed in Annex 1. TablePlay may add, replace or remove such sub-processors and shall maintain an up-to-date electronic list. In the event of a new material sub-processor, TablePlay shall, in principle, inform the Client thirty days in advance. The Client may, within that period, raise a reasoned objection on specific data protection grounds. The Parties shall seek additional safeguards, limitation or a technical alternative. If no reasonable solution exists, the Client may terminate the directly affected part prior to deployment. TablePlay shall impose substantially equivalent obligations and shall remain responsible to the extent that the GDPR so provides.

Article 15 - International Transfers Personal data shall, where possible, be processed within a European region. Sub-processors or group companies may be established outside the EEA or have access thereto. Where required, TablePlay shall use adequacy decisions, standard contractual clauses, supplementary measures or other valid mechanisms. Upon reasonable request, information shall be provided with due regard to confidentiality.

Article 16 - Requests from Authorities TablePlay shall only provide data to competent authorities in the event of a lawful obligation. Where permitted, the Client shall be informed in advance. TablePlay shall assess the authority's competence, scope and legal validity and shall limit the disclosure where possible.

Article 17 - Audits and Information TablePlay shall make available reasonable information, including security documentation, audits, certifications, questionnaires or assurance statements. If this is insufficient, the Customer may require an audit no more than once per calendar year, with thirty days' notice, during office hours, by an independent expert bound by confidentiality, without damage to security, confidentiality or other customers.

The Customer shall bear the costs unless a material attributable breach is established. TablePlay may shield source code, other customer data, vulnerability details and commercially sensitive information where a sufficient alternative exists.

Article 18 - Return and Deletion After termination, TablePlay shall delete or return, at the Customer's choice and insofar as technically and legally possible, data that is processed exclusively on behalf of the Customer. The choice shall be communicated no later than within thirty days. In the absence of a choice, TablePlay may delete or anonymise in accordance with the standard policy. Back-ups may contain data for a maximum of one month and shall be used exclusively for recovery purposes.

Data Processing Agreement and Security Policy TablePlay

Page 5 of 10

Data that is legally required, necessary for legal protection, or anonymised need not be deleted.

Article 19 - Liability The liability provisions of the General Terms and Conditions shall also apply. Each party is responsible for its own privacy obligations. The Customer shall indemnify TablePlay against claims arising from unlawful instructions, absence of a legal basis, insufficient information, unlawful use of Game Data or the input of prohibited sensitive data, insofar as permitted by law.

Article 20 - Term and Termination This Data Processing Agreement shall terminate when TablePlay no longer processes personal data on behalf of the Customer. Confidentiality, security, deletion, liability and audits shall remain in force insofar as their nature so requires.

Article 21 - Law and Disputes This Data Processing Agreement shall be governed by Dutch law. Disputes shall be handled in accordance with the General Terms and Conditions.

Appendix 1 - Sub-processors Supplier

Service

Possible data

Region / role

Supabase

Database, authentication, storage and backend Accounts, table data, nicknames, sessions, scores Primary and logs EU region insofar as configured; core sub-processor

Vercel

Hosting, runtime, content delivery and logging IP address, request, browser, device and application data EEA and possibly US; hosting sub-processor

Twilio SendGrid

Transactional and operational e-mail Name, e-mail address, account information, content and International; e-mail delivery statuse-mail sub-processor

OpenAI / other AI supplier Only in case of activated AI functions

Limited data necessary for the function Depending on configuration; potential sub-processor

Stripe

Business data, invoices, transactions and payment status International; role varies per processing operation

Payments, invoicing and fraud

Google / Meta / LinkedIn Analytics and marketing after consent Website, device, advertising and conversion data International; generally not a sub-processor for re

The current list shall be made available via the website or the customer portal. In the event of a material new sub-processor, the notification and objection procedure of Article 14 shall apply. TablePlay shall not provide identifiable guest data to an AI supplier for general model training, unless expressly, lawfully and transparently arranged otherwise at a later date.

Appendix 2 - Technical and Organisational Measures 1. Access Security • Unique user accounts and secure authentication. • Hashed passwords and restriction of administrative rights. • Access based on role and necessity. • Revocation of access when no longer required. • Additional authentication measures where appropriate.

2. Logical Data Separation • Separation between business Accounts and tenant-specific authorisation.

Data Processing Agreement and Security Policy TablePlay

Page 6 of 10 • Supabase Row Level Security where technically applicable. • Restriction of access to data of other Customers. • Unique table identifiers.

3. Transport and Storage • HTTPS and TLS-secured connections. • Secure communication between browser, application, backend and APIs. • Storage with selected cloud providers. • Restricted employee access and contractual confidentiality. • No storage of passwords in directly readable form.

4. Availability, Logging and Recovery • Back-ups and recovery facilities where appropriate. • Monitoring of technical errors and relevant login attempts. • Detection and investigation of anomalous use. • Back-ups in principle for a maximum of one month. • Logs in principle for a maximum of one year, unless longer retention is required for an incident or dispute.

5. Beveiligde ontwikkeling en leveranciersbeheer • Version control, code review and controlled deployment where appropriate. • Restriction of secrets and keys in source code. • Timely updates of relevant components. • Assessment and remediation of reported vulnerabilities. • Selection of professional suppliers, contractual arrangements and transfer mechanisms.

6. Gegevensminimalisatie en incidentbeheer • No mandatory real names, email or telephone number for Guests. • Temporary nicknames and limited leaderboard visibility. • Deletion or anonymisation after retention periods. • Internal escalation process, investigation, registration, assessment of notification obligation and remedial measures.

Deel B - Security en Coordinated Vulnerability Disclosure 1. Doel en meldadres TablePlay attaches importance to the security of the website, Platform, infrastructure and data. Potential technical vulnerabilities may be reported confidentially via support@tableplay.online with the subject line Security report - confidential.

2. Inhoud van een melding • Clear description of the vulnerability. • Domain, endpoint, screen or system involved.

• Reproducible steps and possible impact.
• Limited screenshots or technical evidence.
• Browser, device or environment used.
• Contact details and, where applicable, a proposal for secure communication.

3. Toegestane handelingen • Only actions necessary to establish the existence of the vulnerability. • Keep impact and data access as limited as possible. • Do not modify, delete or download any third-party data. • Do not affect availability and stop as soon as sufficient evidence exists. • Only investigate systems that are demonstrably under the management of TablePlay.

4. Niet-toegestane handelingen • Social engineering, phishing, physical attacks, brute force and credential stuffing. • Account takeovers, denial-of-service, malware or persistent access. • Modifying, erasing, copying or disclosing data. • Actual manipulation of payments, invoices, coupons or scores. • Investigation of third-party suppliers without their consent. • Burdensome automated scans. • Disclosure before a reasonable period for investigation and remediation has been provided. • Extortion or forcing payment through threats.

5. Reactie en openbaarmaking TablePlay endeavours to confirm receipt within five working days, to assess the report, to ask questions where necessary, to inform the reporter in general terms and to mitigate a verified vulnerability as soon as reasonably possible. The remediation time depends on severity, complexity, suppliers and necessary testing. TablePlay does not guarantee a fixed term. Details will not be disclosed until TablePlay agrees, a reasonable date has been agreed, or at least ninety days have elapsed without a reasonable substantive response or remediation attempt. Personal data, authentication data and exploit code will not be published.

6. Geen algemene bugbounty en juridische benadering TablePlay does not operate a general bug bounty programme and a report does not confer any right to payment, assignment or publicity. TablePlay may, at its own discretion, provide appreciation. TablePlay will in principle not take legal action against a researcher who acts in good faith, within this policy, without causing damage, confidentially and without extortion. This commitment does not apply in the case of evidently criminal, harmful, fraudulent or disproportionate actions and does not bind third parties or authorities.

7. security.txt TablePlay may publish a technical file at /.well-known/security.txt containing the reporting address, a link to the policy, languages, an expiry date and, where applicable, an encryption key. This file must be periodically checked and renewed.

Deel C - Toegankelijkheidsverklaring 1. Ambitie en referentiekader TablePlay strives to make the website, registration, customer portal and guest games usable for a broad range of users, including persons with visual, auditory, motor or cognitive impairments. Where reasonably possible, the principles of WCAG 2.2 level AA are used as a technical and substantive reference framework. This does not constitute a guarantee that every component is fully compliant under all circumstances.

2. Huidige status The complete environment has not yet been independently and comprehensively audited. TablePlay therefore does not currently claim full formal WCAG 2.2 AA conformity. Possible limitations concern real-time game components, time pressure, drag-and-drop, animations, external payment or authentication pages, translations, older colour displays and touch-oriented functions.

3. Maatregelen • Semantic HTML and usable labels where appropriate. • Keyboard operability of essential functions and visible focus. • Sufficient contrast and scalable text. • Alternative texts for informative images. • No essential information conveyed solely through colour. • Understandable error messages and consistent navigation. • Clear buttons and links. • Support for common browsers and screen sizes. • Limitation of unnecessary animation. • Understandable language in the guest environment. • Automated and manual testing where possible.

4. Games and time pressure Some games are by their nature time-bound. Where technically and content-wise possible, TablePlay may offer alternative play modes, extended time limits, less movement, visual alternatives for sound and text or symbols in addition to colour. Not every game mode is equally suitable for every user. Restaurants are encouraged to offer multiple game types.

Data Processing Agreement and Security Policy TablePlay

Page 9 of 10

5. Responsibility of business client The Client remains responsible for physical and operational accessibility of the Location, including placement of QR codes, legibility of printed material, alternative assistance, accessibility of screens, support by staff and own content. QR codes are placed accessibly and visibly and, where reasonably possible, an alternative is offered to Guests who cannot scan independently.

6. Reporting and alternative access Accessibility issues can be reported via support@tableplay.online stating the page or game, device, browser, assistive technology, description and desired solution. TablePlay aims for acknowledgement of receipt within five working days and a substantive response within a reasonable period. Where possible, information can be offered by e-mail, support, an alternative instruction, manual processing or another game option.

7. Disproportionate burden and improvement An adjustment may be postponed if it is not technically feasible, materially affects security, changes the fundamental nature of a game, depends on an external supplier or constitutes a disproportionate organisational or financial burden. TablePlay shall then assess an alternative. TablePlay may take accessibility into account in design, testing, prioritisation, user feedback and external audits and update this statement.

8. Contact TablePlay by Jimani - Jimani B.V. - Albert Plesmanweg 122 - 4462 GC Goes - The Netherlands - Company Registration No. 91644453 - VAT NL865722729B01 - support@tableplay.online.

Data Processing Agreement and Security Policy TablePlay

Page 10 of 10

Supplementary Sub-processor List This sub-processor list forms part of the Data Processing Agreement and Security Policy of TablePlay. The current list may change when suppliers, regions or functions change.

Supplier: Supabase Service: database, authentication, storage and backend. Possible data: accounts, table data, nicknames, sessions, scores and logs. Region / role: primarily EU region insofar as configured; core sub-processor.

Supplier: Vercel Service: hosting, runtime, content delivery and logging. Possible data: IP address, request, browser, device and application data. Region / role: EEA and possibly US; hosting sub-processor.

Supplier: Twilio SendGrid Service: transactional and operational e-mail. Possible data: name, e-mail address, account information, content and delivery status. Region / role: international; e-mail sub-processor.

Supplier: OpenAI / other AI supplier Service: only with activated AI functions. Possible data: limited data necessary for the function. Region / role: depending on configuration; potential sub-processor. TablePlay does not provide identifiable guest data to an AI supplier for general model training, unless this is later expressly, lawfully and transparently arranged otherwise.

Supplier: Stripe Service: payments, invoicing and fraud. Possible data: business data, invoices, transactions and payment status. Region / role: international; role differs per processing activity.

Supplier: Google / Meta / LinkedIn Service: analytics and marketing after consent. Possible data: website, device, advertising and conversion data. Region / role: international; generally not a sub-processor for restaurant game data.